Passing Data Around (Sessions?) 1

[WJProctor]

Ok my problem is that im writtin a page with a login. Now i was hopping the login would be in a popup screen, but how do i get the details back to the main screen so that i can then check when each page loads whether they should have access or not. Should i just pass sessions around or what? Hope this makes sense to someone.

Regards JP

 

[DRJ478]

What kind of authentication do you use?
What is you setup (web server?)

If you use Apache's basic authentication and PHP as an Apache module you should read:

http://www.php.net/features.http-auth

 

[skiflyer]

DRJ

Do you know if this runs into the same issues of performance as this type of authentication does when used with straight up HTML? namely the resending the password each and every page load, and doing so in an insecure manner if not using SSL or some sort of point to point encryption?

-Rob

 

[DRJ478]

skiflyer

I only recommend basic authentication if no form based authentication handling via SSL is available.

The issues with this type of authentication stay the same - as you mentioned. If there is any sensitive data basic authentication without encryption is not a good idea.

The overhead of sending username and password with every request is there, however, a session based authentication system will send the session ID, which is probably longer than username and password combined.

In terms of security, I completely agree, that an insecure plain text sending of username and password is highly undesirable for sensitive context.

The best solution then would be:
Write an Apache mod_auth_login handler that establishes credentials,uses a tracking cookie that is referenced in a credentialing database with the IP and username. The handler triggers redirection to an https:// form based login page that redirects to the requested URL after authentication. Once the credential is esablished the auth handler checks .htaccess privileges. A powerful server is recommended for this - but after all, if the data really is sensitive, it deserves the hardware.

One can scale that down to have an SSL based login with a MySQL backend that keeps track of the session with the credentials.