Re: the "correct" way to login. - Mailing list pgsql-php

I've had problems with this solution.  I had to switch phpPgAdmin from
HTTP-Auth to a standard HTML form because of problems running it on a
non-apache server.

Just an FYI.

-Dan


: I use this solution too, in order to authenticate my users....
:
: My users/password table is into a PostgreSQL database.
:
: Cassio.
: ----- Original Message -----
: From: "Andrew Hammond" <drew@waugh.econ.queensu.ca>
: To: "[PHP] PostgreSQL" <pgsql-php@postgresql.org>
: Sent: Thursday, March 15, 2001 7:37 AM
: Subject: [PHP] the "correct" way to login.
:
:
: > On Wed, Mar 14, 2001 at 02:39:28AM +0100, Christian Marschalek wrote:
: > > > Horrible idea!! Even with an encrypted password. Use PHP
: > > > sessions, and save
: > > > any info on the session (this is saved on a temp file on the
: > > > server, and only
: > > > the session handle is passed to the browser).
: >
: > The HTTP protocol provides userid/password based authentication.
: > Using cookies or hidden variables in a form while a popular
: > approach is not the correct way to do this.  Furthermore, a lot
: > of people out there surf through a junk filter which will
: > probably not let your cookie through.  Mine certainly won't.
: >
: > The solution is to use the HTTP auth stuff.  You can do this
: > either using apache's Require dirrective at the server layer or
: > dirrectly in your scripts.
: >
: > To do it using apache, you need to edit your httpd.conf or
: > appropriate configuration file and put in something like the
: > following:
: >
: > <Dirrectory /foo>
: > AuthType Digest
: > AuthName "realm foo"
: > AuthUserFile /web/users
: > AuthGroupFile /web/groups
: > Require group admin
: > </Dirrectory>
: >
: > Or you could just put the stuff contained in the Dirrectory
: > stanza into a .htaccess file in the dirrectory you want to
: > restrict access too, however that is inefficient since the
: > .htaccess file needs to be stat'd ever time a page is accessed.
: > It also only allows dirrectory level granularity and it's a pain
: > in the ass to make the 401 message meaningfull.  But it's
: > sufficient for many jobs and very fast.  The apache approach also
: > supports the digest method giving some transportation security,
: > while the dirrect php approach does not.
: >
: > To do it in your script, dirrectly you need to pay attention
: > to $PHP_AUTH_USER and $PHP_AUTH_PW.  For example:
: >
: > if(!isset($PHP_AUTH_USER)) {
: >   Header("WWW-Authenticate: Basic realm=\"sis_access\"");
: >   Header("HTTP/1.0 401 Unauthorized");
: >   include ( 'denied.html' );  // or you could redirrect
: >   exit;
: > }
: >
: > Then test the password the same way.  Passwords should (obviously)
: > be stored in an encrypted format (MD5 is suitable, or you can just
: > use good old DES crypt).  This will provide you with localized
: > security.  For transport level security you can either use the
: > digest method for authentication, or if you're really serious, an
: > SSL connection.  Of course if you're _really_ serious you're going
: > to be using x509 cert's and public key crypto, not some rinky dink
: > password based system.
: >
: > > > System Administration: It's a dirty job,
: >
: > Then you're doing it wrong.
: >
: > ---------------------------(end of broadcast)---------------------------
: > TIP 4: Don't 'kill -9' the postmaster
: >
:
:
: ---------------------------(end of broadcast)---------------------------
: TIP 5: Have you checked our extensive FAQ?
:
: http://www.postgresql.org/users-lounge/docs/faq.html