Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17764

Re: lightweight role based security

Show all headers | View raw

On 30.05.2018 at 11:24, madwomans Dad wrote:

> To protect the 'free' resources, a resource, which is a web page,
> includes the following php code as the first lines of the header which
> is included with <?php include 'freeHeader.php';?>
> 
> <?php
> session_start();
> //are you a contact already logged in
> if(!isset($_SESSION["contact"])){
>     //no contact on session
>     header("location: /login/freeLogin.php");
> }
> else{
> ?>
> ...
> <?php
> }
> ?>
> 
> if the user does not have the role contact they are redirected to a
> standalone login page. If they then supply an address they are assigned
> the correct role.
> 
> How 'secure' is this?
> All I want to do at the moment is ensure we have an address before
> allowing access to the resources.

It seems to me that is as secure as your session handling is generally.
For instance, you should mitigate potential session fixation and
hijacking attempts, if not already done.

-- 
Christoph M. Becker

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-30 10:24 +0100
  Re: lightweight role based security "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-05-30 22:56 +0200
    Re: lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-31 15:43 +0100
  Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-01 15:46 +0200
    Re: lightweight role based security Paul Herber <paul@pherber.com> - 2018-06-01 17:15 +0100
      Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-02 01:32 +0200

csiph-web