Path: csiph.com!news.swapon.de!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!feeder5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: "Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups: comp.lang.php
Subject: Re: lightweight role based security
Date: Wed, 30 May 2018 22:56:09 +0200
Organization: solani.org
Lines: 34
Message-ID: <pen358$17m$1@solani.org>
References: <pelqkh$qio$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: solani.org 1527713768 1270 127.0.0.43 (30 May 2018 20:56:08 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Wed, 30 May 2018 20:56:08 +0000 (UTC)
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
In-Reply-To: <pelqkh$qio$1@dont-email.me>
X-User-ID: eJwFwYEBwDAIArCXqiB272zo/ycsKSj0NVVibe3rvuPTjC9gwlk+t+PROgcTGqYILoTO/AEVyxBC
Content-Language: de-DE
Cancel-Lock: sha1:syvljdCYaLfShDE2C0Zf6n5QJTM=
Xref: csiph.com comp.lang.php:17764

On 30.05.2018 at 11:24, madwomans Dad wrote:

> To protect the 'free' resources, a resource, which is a web page,
> includes the following php code as the first lines of the header which
> is included with <?php include 'freeHeader.php';?>
> 
> <?php
> session_start();
> //are you a contact already logged in
> if(!isset($_SESSION["contact"])){
>     //no contact on session
>     header("location: /login/freeLogin.php");
> }
> else{
> ?>
> ...
> <?php
> }
> ?>
> 
> if the user does not have the role contact they are redirected to a
> standalone login page. If they then supply an address they are assigned
> the correct role.
> 
> How 'secure' is this?
> All I want to do at the moment is ensure we have an address before
> allowing access to the resources.

It seems to me that is as secure as your session handling is generally.
For instance, you should mitigate potential session fixation and
hijacking attempts, if not already done.

-- 
Christoph M. Becker