Password Protection 1

[varnix]

We're trying to implement some very simple security for one of our applications.

We have the security working via an included header.cfm file. But we'd like to incorporate it into the application.cfm file so that we don't have to remember to include the header for each new file we create.

Here is what we would like to do:

Application.CFM

<cfapplication name=&quot;phonelog_app&quot; sessionmanagement=&quot;Yes&quot; setclientcookies=&quot;No&quot;>
<!--- Set the application datasource, and logic to only set it once so runtime is minimized --->
<cfset Cookie.CFID = session.CFID>
<cfset Cookie.CFTOKEN = session.CFTOKEN>
<cfif not IsDefined(&quot;application.Initialized&quot>
<cfset application.DS=&quot;phonelog&quot;>
<cfset application.Initialized=&quot;Yes&quot;>
</cfif>
<cfif isdefined(&quot;session.loggedin&quot>
<cfif session.loggedin eq &quot;no&quot;>
<cfinclude template=&quot;login.cfm&quot;>
<cfelse> <!--- session.loggedin defined and is not &quot;no&quot; --->
<!--- output common file header information --->
</cfif>
<cfelse>
<cfinclude template=&quot;login.cfm&quot;>
</cfif>


The login.cfm file displays the actual username/password entry and calls a sub-page called password.cfm that performs the query and authenticates.

Now this does SEEM to work up to a point, it displays the login page, BUT - it continues on to display whatever other page you may have entered. IE index.cfm loads both the login.cfm and the contents of the index.cfm file.

If anyone can suggest a better scheme that doesn't require us having to have the login check in an included header.cfm file - it would be greatly appreciated.

Thanks!

 

[AbeMeister]

ADD cfabort to your template

--->
<!--- output common file header information --->
  </cfif>
  <cfelse>
     <cfinclude template=&quot;login.cfm&quot;>
     <cfabort>
</cfif>

 

[GunJack]

Hey Varnix,

Abemeister's suggestion is a good way to solve your problem the way your app is coded.

I typically don't include a login page though from the application.cfm but use <cflocation url=&quot;login/index.cfm&quot;> to redirect to a separate login directory with a special application.cfm that doesn't check for logged in status. This way my login page, password check page, and any other pages such as password recovery will work. Otherwise, your action pages will not work because the application.cfm executes the login section before getting to the part where you check the password and change their status to logged in.

Good luck,
GJ