Re: Re: Security

Just a couple of additional notes: As the previous poster noted the simplest thing to do is just place a check at the top of security sensitive pages. If it passes just continue, if not redirect them to a login page. I would not rely on the existence of a cookie or the contents of a cookie directly in making authorization decisions. It would be simple enough to just change the cookie from saying I am a peon to say I am God. The most common practice is to simply have the cookie contain a session ID, usually just a hex or BASE64 string with enough bits in it to make it infeasible for someone to write a script to probe for valid session IDs. Then on the back end database, put a value for your "Authorization Level" and use that for your check as the poster discusses below. Also on a miscellaneous note, I wouldn't bother with IP addresses unless you are on a non-DHCP intranet. Dial-up users and Inktomi make IP addresses worthless as an identification measure. Also unless you are just trying to secure from just casual snooping I would run the whole thing from SSL, since there is nothing in any of these schemes to keep any random bozo from just sniffing the packets going across the wire and compromising your security that way. Brian Huddleston Huddleston Consulting ----- Original Message ----- From: "SJONdaMON" <sjondamon@usa.net> To: <php-windows@lists.php.net> Cc: <Budgee@ghs.kzn.school.za> Sent: Friday, October 13, 2000 11:26 AM Subject: [PHP-WIN] Re: Security >Hi >Any suggestions on how I lock access to certain pages, like the >ones where information gets added to the site from? >Using IIS 5 and PHP 4 on Windows 2000 (No A.D.S. yet). >Should I create a table in the DB with usernames and passwords >and use that - I have played with that already, but still I dunnow >how to stop them from typing the direct URL? I do not know how to >use session variables yet, and I have an idea that they would come >in handy. >I'm also battling to get the header(); function to work after >submitting a form. I think also a problem which might be solved >using session variables - if you have code which does this, please >may I see it. >Thanks >Warwick Chapman (1999) >Assistant IT Manager >Glenwood High School, Durban, South Africa >031 2055241 >083 7797094 >www.glenwoodhighschool.co.za Hi Warwick... If you'd like to protect your php pages, you could do two things: 1: Search on the net for scripts. I'd recommend the zend site (www.zend.com), PHP ResourceIndex (php.resourceindex.com) and SourceForge. 2: write your own. Now, if you'd like to write your own, write a function that checks for a session, and if found, quits silently. The best way to do this, is to use authlevels, like so: function checkAuth($level=0) { GLOBAL $authSessionCookie; if ($level = 0) { return; } else { if ($authSessionCookie == '') { // user hasn't authenticated him/herself header("Location: yourloginpage.php"); exit; } // put your code here that get's the authLevel from the database // where the authSession equals the $authSessionCookie. you can // strongen the security with other stuff, like browser used, current // ip address (don't forget proxies), or whatever you want inhere and // makes sense to you. Be shure to add variables that you use to the // GLOBAL statement above... if ($authLevel >= $level) { return; } else { echo "<html>you are not authorized to view this page</html>"; exit; } } It's probably best to place this function in a common library that is used by all your pages, and then call this function first in each page, like this: <?php require("/path/to/common.php"); checkAuth(0); // rest of page ?> Now you can let people view all pages, without having to worry that those who aren't allowed to view a certain page can. Just use checkAuth(0) for all pages wich don't require authentication, and use higher numbers to limit the use of the page. Now you can set authLevels for each group, like so: - Visitors : authLevel = 0 - First Year Students : authLevel = 1 - Other Students : authLevel = 2 - Teachers : authLevel = 3 - Webmasters : authLevel = 4 or whatever's appropriate. You can even extend the function to allow all people with the same authLevel or lower, or only allow people where authLevel equals the authLevel requested, and deny all others... (Like a section for Teachers wich even Webmasters can't view) Hope this helped a bit... Regards, Sjon. ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1 -- PHP Windows Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-windows-unsubscribe@lists.php.net For additional commands, e-mail: php-windows-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net