Password protected areas.

[blitzer]

On my website I have password protected pages. I've found that the easiest way to allow my members to surf through these pages without having to login on every page is to have them login once, and then they can navigate the site with buttons which have a <input type=hidden name=password value=&quot;password&quot;> variable to them.

I know this sounds awkward but it works fine for what I do. What I'm worried about is security. All of the major sites that I go to which have password protected pages seem to be using a cookie to store the password because when I view the source, my password can never be found.

Is this the more secure method of storing a password or do all of the major sites just use it for convenience? If cookies are more secure, if you could post a link to a tutorial on how to write cookies for passwords or something along those lines I'd appreciate it.

thanks,
blitzer

 

[bra1niac]

Think Sessions. I can't give a whole lot of detail as I use Sessions in ASP, however, there has to be an equivalent in Perl.

Sessions are user specific, meaning, once they close the browser, they have to login again. If they send a link to someone while logged in, it can't be viewed. Anyone visting that link will get the login page, etc. They are nice, but get a little tricky. &quot;It's easier to ask forgiveness than it is to get permission.&quot; - Rear Admiral Dr. Grace Hopper

 

[goBoating]

Using cookies is only slightly more secure than a hidden field..... some more but not much more. If you want a significant improvement in securing your communications, I think you would have to go to something like Secure Socket Layers. I have never played with the SSL stuff, so I can't help. But, unless your passing sensitive personal information back and forth, I think the cookies would do what you want.

If you go the cookie route, the cookie would keep track of your users id. When they log in, if they supply a valid user/passwd pair, then you generate a unique temporary user id and send it to the browser in a cookie. Each time a page is requested, you parse the cookie, check the id, and you know wether or not this is a valid user. The persistence of the cookie can be controlled with the 'expire' attribute.

You could do the same exact thing with a hidden field. A difference is that the hidden field will not expire in the browser. A cookie can be set to expire when the browser is closed.

HTH


keep the rudder amid ship and beware the odd typo

 

[tsdragon]

FYI, the &quot;unique temporary id&quot; that goBoating mentions above is also called a &quot;Session ID&quot;. What he's talking about is pretty much the same thing as bra1niac was saying. Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.