Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17763 > unrolled thread

lightweight role based security

Back to article view | Back to comp.lang.php

Contents

  lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-30 10:24 +0100
    Re: lightweight role based security "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-05-30 22:56 +0200
      Re: lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-31 15:43 +0100
    Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-01 15:46 +0200
      Re: lightweight role based security Paul Herber <paul@pherber.com> - 2018-06-01 17:15 +0100
        Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-02 01:32 +0200

#17763 — lightweight role based security

I have a simple web application (no more that 10 'pages' excluding admin 
pages)

There's nothing particularly 'secret' or intrinsically valuable involved 
all I do is ask for an email address which I store in a database. the 
'reward' is access to some free resources that give an intro to various 
subjects with a few nuggets of wisdom thrown in. The idea is to get the 
contact detils of potential customers.

In the (Java) container word there is The concept of container managed 
security. You cofigure your protected resources and the container 
manages the rest. You have one or more roles that you can assign to a 
user and access is controlled accordingly.

My application has only two roles 'contact' which I assign to a visitor
when they hand over a valid email address and 'admin'.

To protect the 'free' resources, a resource, which is a web page, 
includes the following php code as the first lines of the header which 
is included with <?php include 'freeHeader.php';?>

<?php
session_start();
//are you a contact already logged in
if(!isset($_SESSION["contact"])){
	//no contact on session
	header("location: /login/freeLogin.php");
}
else{
?>
...
<?php
}
?>

if the user does not have the role contact they are redirected to a 
standalone login page. If they then supply an address they are assigned 
the correct role.

How 'secure' is this?
All I want to do at the moment is ensure we have an address before 
allowing access to the resources.

Thanks

[toc] | [next] | [standalone]

#17764

On 30.05.2018 at 11:24, madwomans Dad wrote:

> To protect the 'free' resources, a resource, which is a web page,
> includes the following php code as the first lines of the header which
> is included with <?php include 'freeHeader.php';?>
> 
> <?php
> session_start();
> //are you a contact already logged in
> if(!isset($_SESSION["contact"])){
>     //no contact on session
>     header("location: /login/freeLogin.php");
> }
> else{
> ?>
> ...
> <?php
> }
> ?>
> 
> if the user does not have the role contact they are redirected to a
> standalone login page. If they then supply an address they are assigned
> the correct role.
> 
> How 'secure' is this?
> All I want to do at the moment is ensure we have an address before
> allowing access to the resources.

It seems to me that is as secure as your session handling is generally.
For instance, you should mitigate potential session fixation and
hijacking attempts, if not already done.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#17765

On 30/05/2018 21:56, Christoph M. Becker wrote:
> On 30.05.2018 at 11:24, madwomans Dad wrote:
> 
>> To protect the 'free' resources, a resource, which is a web page,
>> includes the following php code as the first lines of the header which
>> is included with <?php include 'freeHeader.php';?>
>>
>> <?php
>> session_start();
>> //are you a contact already logged in
>> if(!isset($_SESSION["contact"])){
>>      //no contact on session
>>      header("location: /login/freeLogin.php");
>> }
>> else{
>> ?>
>> ...
>> <?php
>> }
>> ?>
>>
>> if the user does not have the role contact they are redirected to a
>> standalone login page. If they then supply an address they are assigned
>> the correct role.
>>
>> How 'secure' is this?
>> All I want to do at the moment is ensure we have an address before
>> allowing access to the resources.
> 
> It seems to me that is as secure as your session handling is generally.
> For instance, you should mitigate potential session fixation and
> hijacking attempts, if not already done.

Thanks for taking the time to respond
session_regenerate_id() apparently helps

I'll do some testing

Thanks again

MWD

[toc] | [prev] | [next] | [standalone]

#17766

madwomans Dad wrote:
^^^^^^^^^^^^^
This is not a chat room.  Your real name should be there.

> I have a simple web application (no more that 10 'pages' excluding admin
> pages)
> 
> There's nothing particularly 'secret' or intrinsically valuable involved
> all I do is ask for an email address which I store in a database. the
> 'reward' is access to some free resources that give an intro to various
> subjects with a few nuggets of wisdom thrown in. The idea is to get the
> contact detils of potential customers.
> […]

Are you aware of the General Data Protection Regulation (GDPR) (EU) 2016/679 
that came into effect on 2018-05-25?

<https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679>


PointedEars
-- 
Zend Certified PHP Engineer <http://www.zend.com/en/yellow-pages/ZEND024953>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#17767

On Fri, 01 Jun 2018 15:46:21 +0200, Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:

>madwomans Dad wrote:
>^^^^^^^^^^^^^
>This is not a chat room.  Your real name should be there.

No, it doesn't.


-- 
Regards, Paul Herber
http://www.paulherber.co.uk/
      

[toc] | [prev] | [next] | [standalone]

#17768

Paul Herber wrote:

> On Fri, 01 Jun 2018 15:46:21 +0200, Thomas 'PointedEars' Lahn
> <PointedEars@web.de> wrote:

Attribution _line_, not attribution novel?

>>madwomans Dad wrote:
>>^^^^^^^^^^^^^
>>This is not a chat room.  Your real name should be there.
> 
> No, it doesn't.

“It doesn’t” should be there? :-)

So “Paul Herber” is not your real name? :-D

-- 
PointedEars
Zend Certified PHP Engineer <http://www.zend.com/en/yellow-pages/ZEND024953>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web