Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7847

Re: Digest Authentication

Show all headers | View raw

On 12/18/2012 8:55 PM, xkit wrote:
> On Dec 13, 8:15 pm, Jerry Stuckle <jstuck...@attglobal.net> wrote:
>> On 12/13/2012 7:49 PM, dhtmlkitc...@gmail.com wrote:
>>
>>> I am trying to implement a password protected area of a site. I have never done this before.
>
> [...]
>
>> One other point - this is NOT a very good script.  For instance, you
>> should NEVER use die() on a production system, especially for a
>> non-critical error.  die() terminates processing of the page
>> immediately, resulting in invalid HTML at the browser.
>>
> Wow, you're right!
>
> Should I use `echo`?
>
> When testing locally, after once entering wrong credentials, I
> continue to get
>   `die('Wrong Credentials!');` and am given no opportunity to enter
> correct credentials.
>
>
> 1. click "cancel"
> 2. reload.
> 3. enter wrong credentials and click "login"
> 4. reload.
>
> Desired result:
>   Prompt for login credentials.
>
> Actual result:
>   "Wrong Credentials!"
>
> Is PHP_AUTH_DIGEST set automatically? And how and where in the script?
> Also, what should I look for in print_r()?
>
>> Additionally, I think a very low percentage of PHP sites use such
>> authentication.  Most have their own login page (using https protocol).
>
> I'm not sure if we can do https here (it's a small, low budget project
> on Yahoo Small Business). For our app, we'll use a PayPal IPN of $1 to
> access the area of the site, and we're not worried MIM attack to get
> free access. I convinced the site owner to use a managed, password-
> protected area the site, in favor of password protecting the zip file
> and zipping up the site contents and giving a "hidden" URL.
>
> If HTTPS isn't in budget, I'll try to amend the linked digest script.
>
> If I'm on the wrong track, please advise other strategies for this
> simple app.
>
> Thank you,
> --
> Garrett
>

If you're doing ecommerce (even if you're using Paypal), you NEED to use 
https.  Otherwise your site is NOT secure.  It is too easy to intercept 
the data being entered - i.e. someone using a wireless hot spot, on a 
cable modem at home or any of a couple of dozen other connections will 
easily allow a hacker to get everything he/she wants.

And if your site is hacked, the cost of NOT using it is much, much 
higher than the cost of using it.  If you can't afford it, you can't 
afford the site.

Read M. Strobel's post.  And if you're not familiar with creating a 
secure site, hire someone who is.  This is not a job for a beginner.

And BTW - giving a "hidden URL" is no security at all.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Digest Authentication dhtmlkitchen@gmail.com - 2012-12-13 16:49 -0800
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:15 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:31 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 23:15 -0500
    Re: Digest Authentication xkit <dhtmlkitchen@gmail.com> - 2012-12-18 17:55 -0800
      Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-18 21:08 -0500
        Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 09:40 -0800
          Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-19 15:02 -0500
            Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 20:59 -0800
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:02 -0500
          Re: Digest Authentication "Peter H. Coffin" <hellsop@ninehells.com> - 2012-12-19 14:30 -0600
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-19 17:26 -0500
          Re: Digest Authentication Scott Johnson <noonehome@chalupasworld.com> - 2012-12-19 17:02 -0800
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-20 20:17 -0500
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 23:10 -0500
              Re: Digest Authentication The Natural Philosopher <tnp@invalid.invalid> - 2012-12-21 10:19 +0000
          Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-20 09:57 +0100
            Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:06 -0500
    Re: Digest Authentication legalize+jeeves@mail.xmission.com (Richard) - 2012-12-22 19:15 +0000
  Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-14 12:05 +0100

csiph-web