Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17765

Re: lightweight role based security

Show all headers | View raw

On 30/05/2018 21:56, Christoph M. Becker wrote:
> On 30.05.2018 at 11:24, madwomans Dad wrote:
> 
>> To protect the 'free' resources, a resource, which is a web page,
>> includes the following php code as the first lines of the header which
>> is included with <?php include 'freeHeader.php';?>
>>
>> <?php
>> session_start();
>> //are you a contact already logged in
>> if(!isset($_SESSION["contact"])){
>>      //no contact on session
>>      header("location: /login/freeLogin.php");
>> }
>> else{
>> ?>
>> ...
>> <?php
>> }
>> ?>
>>
>> if the user does not have the role contact they are redirected to a
>> standalone login page. If they then supply an address they are assigned
>> the correct role.
>>
>> How 'secure' is this?
>> All I want to do at the moment is ensure we have an address before
>> allowing access to the resources.
> 
> It seems to me that is as secure as your session handling is generally.
> For instance, you should mitigate potential session fixation and
> hijacking attempts, if not already done.

Thanks for taking the time to respond
session_regenerate_id() apparently helps

I'll do some testing

Thanks again

MWD

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-30 10:24 +0100
  Re: lightweight role based security "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-05-30 22:56 +0200
    Re: lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-31 15:43 +0100
  Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-01 15:46 +0200
    Re: lightweight role based security Paul Herber <paul@pherber.com> - 2018-06-01 17:15 +0100
      Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-02 01:32 +0200

csiph-web