Re: lightweight role based security

Path	csiph.com!news.swapon.de!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!feeder5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From	"Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups	comp.lang.php
Subject	Re: lightweight role based security
Date	Wed, 30 May 2018 22:56:09 +0200
Organization	solani.org
Lines	34
Message-ID	<pen358$17m$1@solani.org> (permalink)
References	<pelqkh$qio$1@dont-email.me>
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	8bit
X-Trace	solani.org 1527713768 1270 127.0.0.43 (30 May 2018 20:56:08 GMT)
X-Complaints-To	abuse@news.solani.org
NNTP-Posting-Date	Wed, 30 May 2018 20:56:08 +0000 (UTC)
User-Agent	Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
In-Reply-To	<pelqkh$qio$1@dont-email.me>
X-User-ID	eJwFwYEBwDAIArCXqiB272zo/ycsKSj0NVVibe3rvuPTjC9gwlk+t+PROgcTGqYILoTO/AEVyxBC
Content-Language	de-DE
Cancel-Lock	sha1:syvljdCYaLfShDE2C0Zf6n5QJTM=
Xref	csiph.com comp.lang.php:17764

Show key headers only | View raw

On 30.05.2018 at 11:24, madwomans Dad wrote:

> To protect the 'free' resources, a resource, which is a web page,
> includes the following php code as the first lines of the header which
> is included with <?php include 'freeHeader.php';?>
> 
> <?php
> session_start();
> //are you a contact already logged in
> if(!isset($_SESSION["contact"])){
>     //no contact on session
>     header("location: /login/freeLogin.php");
> }
> else{
> ?>
> ...
> <?php
> }
> ?>
> 
> if the user does not have the role contact they are redirected to a
> standalone login page. If they then supply an address they are assigned
> the correct role.
> 
> How 'secure' is this?
> All I want to do at the moment is ensure we have an address before
> allowing access to the resources.

It seems to me that is as secure as your session handling is generally.
For instance, you should mitigate potential session fixation and
hijacking attempts, if not already done.

-- 
Christoph M. Becker

Thread

lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-30 10:24 +0100
  Re: lightweight role based security "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-05-30 22:56 +0200
    Re: lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-31 15:43 +0100
  Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-01 15:46 +0200
    Re: lightweight role based security Paul Herber <paul@pherber.com> - 2018-06-01 17:15 +0100
      Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-02 01:32 +0200

csiph-web