Web design advice?

Miscellaneous Forums/General Discussion/Web design advice?

I've been asked to design a site for someone. No CMS but he's asked if I can protect unauthorised access to the site via password. How hard is this to do? I imagine there are two ways: either unique login/password for each user, or a universal password to get past a splash screen which he personally gives to people. The unique login is preferable, but what's involved server-side and design-wise? I have no experience of anything other than designing html sites in Dreamweaver (I do know vaguely how to code html as well).

Any advice much appreciated.

The question "how hard is this to do" is impossible to answer, since it all depends on ambition level, physical preconditions (i.e. what server type, your access level on the server (both on the web service and on the physical machine) and sequrity requrements.

To be able to suggest how to solve this you need to specify these requirements. Let's look at an example:

Server Type: IIS 6.0

Access Level: Adminstrator rights on the entire machine

Sequrity Requrements: Low (We do want to restrict unauthorized access, but we will not keep the secret formula on how to transform lead to gold on this server)

Ambiton Level: Easiest possible. We do not need to integrate the login process into the GUI/Workflow of the site, a standard windows login dialog is ok.

In this scenario it would be easy to use IIS built in support for authorization. A matter of configuring a couple of settings on the web server and managing groups and users on the machine. Should be pretty easy. BUT, change any of the parameters above and you might find that this expands in to a massive task. So you need to find out (at least) the answers to these questions before you even think about promising this functionality.

I've been in projects were we have spent multiple man-months just getting the user access to work the way the client wants. And I've been in projects where all the user access stuff was done in one afternoon.

So find out which one it is before you start...

If you have no experience working with web servers, the scenario described above (which really was the simplest I could dream up) still might prove a bit daunting. As always, 90% of configuration is knowing what to configure and where to find it :)

http://www.htmlite.com/HTA006.php

There are scripts available that can help with password creation and management.

Wow. Might as well have been Greek! But gives me some pointers as to how to start - thanks. Geoff - is that the only/standard way to do it, or one specific way?

How hard is this to do?
Trivial. Apache also has built-in support for http authentication (I'm assuming that's what ISS does), and setting it up is a matter of changing three text files, all very well documented, and all having extensive tutorials online on how to do it.

I agree with FD, it is trivial, unless you want to support access levels per page it's a piece of urinary matter.

Most hosting services have a directory security feature anyway so you don't even need to learn how to use htaccess.

I coded a system from scratch for www.recipicky.com It is really easy once you learn PHP which is in itself really easy.

If you can code in blitz PHP won't take you a day to learn. Pick up a good book, there are a lot that just address the issue you have.

Lead to Gold?!

<strike>http://www.strindbergandhelium.com/iron.html</strike>

Damn. It's offline. :(

In my experience user access is one of those things that always will com back an bite you in the ass, if you haven't really detailed how it should work with the client.

Since it is almost part of any web-project that isn't a static html page, you think: "Ah, how hard can it be? I've done this dozens of times before."

The problem is that the whole process is extremly volatile. A requiremet that to the client is trivial can topple your entire model and create massive amounts of work.

Looking at the example GeoffTheGyratingGiraffe gave there is one precondition that is a really heavy precondition that is only mentioned in passing:

The file must be uploaded in ASCII format and stored above your WWW or public_html folder. That is, in your online root (home) folder. (You may have to ask your host provider exactly what path this is and where it is located.)


Well, in many cases you do not have access outside of your own root. And remember that if you have users, you have maintenance (Yes, users come and go, they forget passwords etc.) So while you might convince the sysadm of the server to upload it once, this won't do. You must have access to the file to do maintenace. That might be a completely different ballgame both form a sequrity and an economical point of view.

So get the requirements (exactly) from the client first! Then figure out the solution...

in php
<?
session_start();

if ((!$_POST[username]) || (!$_POST[password])) {
} else {

   if ($_POST[username] == " the wanted username ") {

       if ($_POST[password] == " the wanted password ") {

         $_SESSION[logged] = "yes";

      }

   }

}

if (!($_SESSION[logged] == "yes")) {

   echo " --- HTML form with 2 text boxes to accept user info in POST form that links to this very file---";
   die();

}

?>

HTML you want protected



You can stick that php above any html file, substitute the right username and password for the placeholders I used of the wanted username and the wanted password and it will work across all the pages you want protected, and will only ask for the username and password again if the client closes the browser.

Its a little sloppy with the gate logic cause I yanked it out of another file that required the wonky strange gates and odd nots and stuff to go in the than side of the if than else.

Thanks! Am I right in thinking that's for one universal login and password, not unique ones for each user? I'm not sure how much protection this bloke is bothered to have...

well.. you can copy the
   if ($_POST[username] == " the wanted username ") {

       if ($_POST[password] == " the wanted password ") {

         $_SESSION[logged] = "yes";

      }

   }


section as many times as you like for each new member... change the pass and username for each one... that makes sense for less than 20 pages... isn't annoying for less than 5...

You'd have to set up a MySQL database to not do it hard coded like this... since a text file wouldn't be very secure either...

tho... for a price.. I could prolly think up a way to do it without a database and still be secure

Hmmm... not sure that would be a good idea. I don't think matey would like having to get me to recode the website every time he gets a new user. I suppose I could hard code 100 names and give him the list to hand out but it would still be a bit slapdash. How would that text file work? As long as it has the appearance of security I think that's all he cares about. (I'd let him know exactly how secure it is or isn't and he can decide.)

He still hasn't given me his exact needs, but I guess it'll either be him handing out usernames and passwords via email, or the website allowing username/password setup by the user. Problem is, he can't really decide what he wants so I need to figure out what's possible my end so he can choose.

you can save a list of users and passwords like //name@name@name@name and
//pass@pass@pass@pass

and save the files as pass.php and name.php and people will just get blank pages when they try to go to those pages since it is all commented out. but the system can read the files in line and match them up. then you either manually enter new names and passes to the end of the list, or better... you have a little admin thing at the top of the page to add them...

<?
session_start();

if ((!$_POST[NewUsername]) || (!$_POST[NewPassword])) {
} else {

   if (!("" == $_POST[NewUsername])) {

      if (!("" == $_POST[NewPassword])) {

         $Title = "name.php";
         $thestuff = fopen($Title, "r");
         $thelist = fread($thestuff, 65000);
         fclose($thestuff);

         $thelist = str_replace('?>', '', $thelist);
         $thelist .= "@$_POST[NewUsername]?>";

         $thestuff = fopen($Title, "w");
         fputs($thestuff, $thelist);
         fclose($thestuff);

         $Title = "pass.php";
         $thestuff = fopen($Title, "r");
         $thelist = fread($thestuff, 65000);
         fclose($thestuff);

         $thelist = str_replace('?>', '', $thelist);
         $thelist .= "@$_POST[NewPassword]?>";

         $thestuff = fopen($Title, "w");
         fputs($thestuff, $thelist);
         fclose($thestuff);

      }

   }

}

if ((!$_POST[username]) || (!$_POST[password])) {
} else {

   if ($_POST[username] == " the guy's username ") {

       if ($_POST[password] == " the guy's password ") {

         $_SESSION[logged] = "yes";
         $_SESSION[admin] = "yes";

      }

   }

   $Title = "name.php";
   $thestuff = fopen($Title, "r");
   $thelist = fread($thestuff, 65000);
   fclose($thestuff);

   $thelist = str_replace('<?//', '', $thelist);
   $thelist = str_replace('?>', '', $thelist);
   $namelist = split ("@",$thelist);

   $Title = "pass.php";
   $thestuff = fopen($Title, "r");
   $thelist = fread($thestuff, 65000);
   fclose($thestuff);

   $thelist = str_replace('<?//', '', $thelist);
   $thelist = str_replace('?>', '', $thelist);
   $passlist = split ("@",$thelist);
   
   $sizeoflist = count($passlist);

   for ($counter = 0; $counter <= $sizeoflist; $counter++) {

      if ($_POST[username] == $namelist[$counter]) {

          if ($_POST[password] == $passlist[$counter]) {

             if (!("" == $passlist[$counter])) {

                if (!("" == $namelist[$counter])) {

                  $_SESSION[logged] = "yes";

               }

            }

         }

      }

   }

}

if (!($_SESSION[logged] == "yes")) {

   echo " --- HTML form with 2 text boxes to accept user info in POST form that links to this very file---";
   die();

}

?>
<html>
<head>
<title></title>
</head>
<body>

<?

if ($_SESSION[admin] == "yes") {

   echo "<form to gather new users and passes in POST form NewUsername and NewPassword and submit button>";

}

?>

</body>
</html>


pass.php looks like

<?//password_1@password_2@password_3@password_4?>


name.php looks like


<?//username_1@username_2@username_3@username_4?>


Both pass and name .php should START OUT with just a <?//?> on the top line.

Once again... you have to add the form things yourself... the should be in POST and should link back to the same file... You will need to manually enter the name of the file in the code... but hey... you only have to do it once... also.. all the php files need to be in the same folder... otherwise it won't be able to find pass.php and name.php ... however, you could directly link to them by sticking the whole file path (not url) starting with C:/ or E:/ or whatever...

When you use echo you need to escape out "s so ....

echo "<table width = "95%" height = "25">";
echo "<tr>";
echo "<td>";
echo "<form method = "POST" action = "index.php">";
echo "New Username: <input type = "text" name = "NewUsername">";
echo "New Password: <input type = "text" name = "NewPassword">";
echo "<input type = "submit" value = "Change!">";
echo "</form>";
echo "</td>";
echo "</tr>";
echo "</table>";


Will create the admin member adder for the top of the guy's own page only... I didn't want to stick it in the code, cause it might not look like what you want.


Keep in mind... I haven't tested any of this... and it may not work as planned cause I might have left out a ; or something dumb... test it out on a dummy page.. tell me if it works.

Wow, thanks. It looks a bit daunting at first read... I'll have a thorough nose into this and let you know how it works. You're a star :)

Just make sure you tell me if it works well or not.

Taken me a while to get to try it... I couldn't get it to work at all, I guess I'm missing something. Both examples didn't work either in Safari or IE (on mac). They just brought up an empty window. I'm just not sure what I'm actually reading in those given examples :(

Wouldn't the easiest way be like so:

Most webhosts have an admin control panel of some sorts (mine is CPanel) and allow you to password protect a folder very easily.

For example www.yourdomain.com/pages - password protect the "pages" folder and put all protected pages in there.

Then on the main www.yourdomain.com - you have a welcome page and a continue button which takes you to the password protected area.

Or am I missing something obvious?

*edit* if everyone sees the same content and only one person is allowed to add/change the content then unique logins are overkill.