Creating a Login System

[Guest_imported]

Hello, I have tried to exercise due diligence before bothering anybody. I have read all of the threads that seem to deal with session or client management but I am still a bit unclear. I want to create a basic login system where a user needs to login before accessing a set of pages. I understand that I need to have something like the following in application.cfm:


<CFAPPLICATION NAME=&quot;MyApp&quot;
SESSIONMANAGEMENT=&quot;YES&quot;
CLIENTMANAGEMENT=&quot;YES&quot;
SETCLIENTCOOKIES=&quot;YES&quot;
SESSIONTIMEOUT=&quot;#CreateTimeSpan(0,0,20,0)#&quot;
APPLICATIONTIMEOUT=&quot;#CreateTimeSpan(2,0,0,0)#&quot;>
<CFSET APPLICATION.ADDTOKEN = &quot;CFID=#client.cfid#&amp;CFTOKEN=#client.cftoken#&quot;>


I also am fine with initially validating a login from the actual login page (ie. checking the provided username/password against these in my database. My question is what do I put at the top of all &quot;protected&quot; pages to ensure that the user is indeed logged in and has not timed out. If I merely check that CFID, for example, IsDefined it would be easy for anyone to append the variable CFID (set to anything) to the URL and access the page. I know that I am missing something basic here. Please Help! Also, is my application.cfm code appropriate? Thanks so much!

 

[GunJack]

I would recommend just setting a session variable to indicate their login status. You could do this after authenticating the user like this.

<cfset session.loginStatus=&quot;yes&quot;>

At the top of any protected page, just add this:

<cfparam name=&quot;session.loginStatus&quot; default=&quot;no&quot;>
<cfif session.loginStatus is &quot;no&quot;>
<cflocation url=&quot;Login.cfm&quot;>
</cfif>

Before logging in or after their session expires, the session.loginStatus variable will not be present and will be given a default value of &quot;no&quot; on any protected page. This will then cause them to be re-directed to a login or error page of your choice. If they have logged in, CF will pass by this re-direction and show the requested page.

Hope this helps,
GJ

 

[Guest_imported]

Thanks! I used this in combination with a log off button that sets session.loginStatus back to NO. I appreciate your time