lightweight role based security

From	madwomans Dad <dsvirtual58@gmail.com>
Newsgroups	comp.lang.php
Subject	lightweight role based security
Date	2018-05-30 10:24 +0100
Organization	A noiseless patient Spider
Message-ID	<pelqkh$qio$1@dont-email.me> (permalink)

Show all headers | View raw

I have a simple web application (no more that 10 'pages' excluding admin 
pages)

There's nothing particularly 'secret' or intrinsically valuable involved 
all I do is ask for an email address which I store in a database. the 
'reward' is access to some free resources that give an intro to various 
subjects with a few nuggets of wisdom thrown in. The idea is to get the 
contact detils of potential customers.

In the (Java) container word there is The concept of container managed 
security. You cofigure your protected resources and the container 
manages the rest. You have one or more roles that you can assign to a 
user and access is controlled accordingly.

My application has only two roles 'contact' which I assign to a visitor
when they hand over a valid email address and 'admin'.

To protect the 'free' resources, a resource, which is a web page, 
includes the following php code as the first lines of the header which 
is included with <?php include 'freeHeader.php';?>

<?php
session_start();
//are you a contact already logged in
if(!isset($_SESSION["contact"])){
	//no contact on session
	header("location: /login/freeLogin.php");
}
else{
?>
...
<?php
}
?>

if the user does not have the role contact they are redirected to a 
standalone login page. If they then supply an address they are assigned 
the correct role.

How 'secure' is this?
All I want to do at the moment is ensure we have an address before 
allowing access to the resources.

Thanks

Back to comp.lang.php | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-30 10:24 +0100
  Re: lightweight role based security "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-05-30 22:56 +0200
    Re: lightweight role based security madwomans Dad <dsvirtual58@gmail.com> - 2018-05-31 15:43 +0100
  Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-01 15:46 +0200
    Re: lightweight role based security Paul Herber <paul@pherber.com> - 2018-06-01 17:15 +0100
      Re: lightweight role based security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-02 01:32 +0200

csiph-web