paulchwd

Hello all,

I'm looking to restrict access to various pages of my website. I have curently an app in place which queries a database for the credientials (user + password) entered and sets a flag to true if a match was found.

I heard about comparing the HTTP_REFERER header to the HTTP_HOST header, but heard it is useless because soem browsers dont support those headers and hackers can mess with them easily,

do you have any sugestions?


Thanks

bja888

You don't need to pass session data through the browser. Keep it on the server with the session object. If you really worried about it check browser and IP every time a page is accessed.

paulchwd

Thanks for your reply

What do you mean by " Keep it on the server with the session object"--> could you show me an example pls...thanks

this is what i am doing nowsee attached, it wont let me upload a .asp or .inc file)

Validate is the main validation page that checks u at login

and val1 is the include file i use on each page to check if you logged in

Thanks

Attached Files

	validate.txt (1.0 KB, 51 views)
	val1.txt (81 Bytes, 47 views)

bja888

Your already useing it in your validate.txt file.

That is stored on the server is memory recalls. I believe there is no way for anyone to pull that off the server.

OpenLoop

As far as i know, restricting access to parts of a website is the job of the web server. I'm not sure how to do that in IIS but if you're using apache, you can specify the directories that have restricted access.

paulchwd

Oh ic, you mentioned checking ip's how would i go about that? And how do I componsate for dynamic (DHCP) ip's

InfoGeek

I checked your Username/password validation script. It can be easily cracked in 1 min(and no thinking) using SQL injection. google SQL injection for more info about the attack.

__________________
PFO - My daily dose of technology.

bja888

Personally, I would use a offline temp folder. Generate a random file name for a text file. Assoiate that file with the session. Write in that text file the persons IP address then check the file to see if it matches every time you open a page.

paulchwd

Thanks for the reply

1) what do you mean by "offline temp folder." if its not on my server (this will eventually be uploaded to a server other then my IIS which i have limited control over) how will i reference it

2) To info geek: Thanks for the tip, how can i make it more secure ?

3) How can I protect my Access database so that it cannot be downloaded by going for example www.mydomain.com/mydatabase

thanks for all the help

InfoGeek

Read about the attack and find out why your script is vunerable to it. Then modify your script to make it secure.

Don't give read permission to the world.(chmod 700 mydatabase)

__________________
PFO - My daily dose of technology.