Web Site Security

[ecugrad]

Need advice on security. I'm writing a application that will be used by 40-50 users consisting of at least 10 groups. Each group having different page access levels.

Do I use NT folder & file permissions or write something using ASP. If I need to use ASP, does anybody know a resource a beginner might be able to understand..

Thanks,Mike

 

[Mdiaz]

I secure sections of a web site using sessions, the sessions are authenticated through a lookup in a database table which contains; password, userid, and which pages they can view. i.e., "Admin", "Sales", Whatever"...
This is a boleen field. If the user has permission to enter a page a session is created, i.e. Session("Admin&quot = "sure"

On the page you wish to secure place something like this on the first line.

<%if session(&quot;Admin&quot <> &quot;sure&quot; Then
response.redirect &quot;/noaccess.asp&quot;
End If%>

naturally you would want to create a noaccess.asp page to tell the creep he has no permission to view the page.

Also, make sure you protect your web site from SQL Injection where folks can malisiously enter code to bypass and mess with your data.

Hope this gets you started.

Mike Diaz...

 

[shadyness]

Like Mdiaz states you can use Session or Cookie variables, but you do not want to rely upon those totally, becuase they are static text files being transferred on the internet. But, rather use those in conjunction with other options for passing the data, like Form Variables and Query String variables. Also, I find the best way to use a script like the one above, is to make it it’s own .asp and simply use a SSI to include it on every page, like:

<!-- #INCLUDE FILE=&quot;secure.asp&quot; -->

However, I would read up on enabling HTTP Authentication capabilities of IIS 5.0 if you are running that, but if not at least study up on Hybrid Authorization scripts in base64 encryption/ decryption, which is not the best, but better than a simple session or cookie variable. Most books have scripts pre-written for this (Wrox Press, Sam’s Teach Yourself, and of course O’Reilly).

One other thing to be wary of is placing a heavy load on your server. If your site is going to be getting more than your predicted user level, make sure the server is not checking X amount of people for x amount of pages every view.