Exception handling is one of Perl's exceptional (ha!) weak points. You might want to read about Object-Oriented Exception Handling. It's a nice article, though it has some bugs in the code.

If you're going to keep it simple and return false, don't return 0 or undef! Instead, use a bare return:

unless ( $password_validated ) {
  # return 0; # <-- Usually bad
  return;
}
else {
  # do what must be done
}
[download]

The problem with using return 0; or return undef; is that someone using your code might be assigning the results to an array. If so, checking for "truth" in the array will give a false positive because the array will then have one element whose value is zero or undef. Evaluating the array in a boolean context then evaluates as true instead of the expected false.

Cheers,
Ovid

New address of my CGI Course.
Silence is Evil

IMO a reasonable way is to have the upper layer (the user layer) only be aware of yes or no and the lower loayer doing all the work.

It also depends on what you're trying to achive. do you want real time IDS? or do you want auditing?

I wrote a system once that performed NRT IDS. The approach i used was the upper layer saying yes or no, the lower layer deciding if the login was right or wrong and logging the attempts, and a seperate daemon that would poll the database to determine if this was a brute force attack (by our definition, eg n attempts in a set period).

If all you want is auditing, then pump you yes/no requests into a logfile and parse it separately...

To prevent people from hammering, your validation methods would parse a logfile, db, or mem cache before it validated the login attempt to see if your threshold of 'hammering' was met.

You could even go a step further, and daemonise your authentication process, making that process accessable to other systems, and so it could authenticate against various systems using parameters.... Take it a step further, use an XML (TCP) based transaction with XML::Simple and you've got a real cool, extensible, centralised authentication system capable of meeting whatever requirements you come up with.

I am the feature creep, I come from round your way...

Well this is a standardized ( or so I hope ) module that my self and the other people working on my project will use to restrict entrance to the system...But Ryszard's idea of layers sounds realy cool and then all I would have to pass is 1 or 0 if it is valid or not. Thank you

However this does NOT mean $! is readonly, you can change it. If you want it to be meaningful, set it to a number outside the range that being used by system. Again, there is a big chance that, at the time you check its value, it has been reset by the system, so you don't get what you want.

Is this going to be accessible on your local network or over the internet? What methods have you tried so far for tracking the number of logins?

As far as letting the calling script know the result? I'd use a return code that indicated success or failure. 0 meaning success, this leaves all other valid positive numbers for error codes. If successful, you need to pass on the info on the person logging in.