Re: the "correct" way to login.

From: "Dan Wilson" <phpPgAdmin(at)acucore(dot)com>
To: "[PHP] PostgreSQL" <pgsql-php(at)postgresql(dot)org>
Subject: Re: the "correct" way to login.
Date: 2001-03-15 18:31:19
Message-ID: 002f01c0ad7e$2114cdf0$533987cf@corp.peoplesoft.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-php

I've had problems with this solution. I had to switch phpPgAdmin from
HTTP-Auth to a standard HTML form because of problems running it on a
non-apache server.

Just an FYI.

-Dan

: I use this solution too, in order to authenticate my users....
:
: My users/password table is into a PostgreSQL database.
:
: Cassio.
: ----- Original Message -----
: From: "Andrew Hammond" <drew(at)waugh(dot)econ(dot)queensu(dot)ca>
: To: "[PHP] PostgreSQL" <pgsql-php(at)postgresql(dot)org>
: Sent: Thursday, March 15, 2001 7:37 AM
: Subject: [PHP] the "correct" way to login.
:
:
: > On Wed, Mar 14, 2001 at 02:39:28AM +0100, Christian Marschalek wrote:
: > > > Horrible idea!! Even with an encrypted password. Use PHP
: > > > sessions, and save
: > > > any info on the session (this is saved on a temp file on the
: > > > server, and only
: > > > the session handle is passed to the browser).
: >
: > The HTTP protocol provides userid/password based authentication.
: > Using cookies or hidden variables in a form while a popular
: > approach is not the correct way to do this. Furthermore, a lot
: > of people out there surf through a junk filter which will
: > probably not let your cookie through. Mine certainly won't.
: >
: > The solution is to use the HTTP auth stuff. You can do this
: > either using apache's Require dirrective at the server layer or
: > dirrectly in your scripts.
: >
: > To do it using apache, you need to edit your httpd.conf or
: > appropriate configuration file and put in something like the
: > following:
: >
: > <Dirrectory /foo>
: > AuthType Digest
: > AuthName "realm foo"
: > AuthUserFile /web/users
: > AuthGroupFile /web/groups
: > Require group admin
: > </Dirrectory>
: >
: > Or you could just put the stuff contained in the Dirrectory
: > stanza into a .htaccess file in the dirrectory you want to
: > restrict access too, however that is inefficient since the
: > .htaccess file needs to be stat'd ever time a page is accessed.
: > It also only allows dirrectory level granularity and it's a pain
: > in the ass to make the 401 message meaningfull. But it's
: > sufficient for many jobs and very fast. The apache approach also
: > supports the digest method giving some transportation security,
: > while the dirrect php approach does not.
: >
: > To do it in your script, dirrectly you need to pay attention
: > to $PHP_AUTH_USER and $PHP_AUTH_PW. For example:
: >
: > if(!isset($PHP_AUTH_USER)) {
: > Header("WWW-Authenticate: Basic realm=\"sis_access\"");
: > Header("HTTP/1.0 401 Unauthorized");
: > include ( 'denied.html' ); // or you could redirrect
: > exit;
: > }
: >
: > Then test the password the same way. Passwords should (obviously)
: > be stored in an encrypted format (MD5 is suitable, or you can just
: > use good old DES crypt). This will provide you with localized
: > security. For transport level security you can either use the
: > digest method for authentication, or if you're really serious, an
: > SSL connection. Of course if you're _really_ serious you're going
: > to be using x509 cert's and public key crypto, not some rinky dink
: > password based system.
: >
: > > > System Administration: It's a dirty job,
: >
: > Then you're doing it wrong.
: >
: > ---------------------------(end of broadcast)---------------------------
: > TIP 4: Don't 'kill -9' the postmaster
: >
:
:
: ---------------------------(end of broadcast)---------------------------
: TIP 5: Have you checked our extensive FAQ?
:
: http://www.postgresql.org/users-lounge/docs/faq.html

In response to

Responses

Browse pgsql-php by date

  From Date Subject
Next Message Jon Tai 2001-03-17 09:58:15 Re: the "correct" way to login.
Previous Message Cássio Alexandre Pereira de Castro 2001-03-15 12:16:11 Re: the "correct" way to login.