Monks,

I'm responsible for the coding of a community website for a group in the North of the UK. As part of this, we need to include some "member-only" features, such as planning of events, profiles and more extensive contact information than we want to make publically accessible.

I've developed a script in CGI that will take, and validate, a username and password, storing both pieces of information in instance variables within the script (the password obviously crypted). The script can then output the site's menu dependant on whether the user is logged in or not. I should point out that the user validation and menu output is handled by the same script - the login state is not passed out to a secondary script. The menu itself is in a frame so that it doesn't get refreshed, and hence the username/password variables reset each time a content page is loaded.

When member-only content is accessed, a second script, serveContent, is called, into which is passed the username, a crypted version of the password, and the page which the user is attempting to access, which again checks user authorisation and either displays the requested page or demands the user log in.

I don't want to drop cookies to control the login for various reasons - not least because they've caused problems in the past within the group and there's a lot of opposition to them. This is fine, I don't need data persistance - when the entire page is refreshed, the instance variables containing the username and password within the login script are reset and the user is logged out.

I've set a quick version of the page running with this code and it seems to work well - logins/logouts are handled efficiently and the load-time is nice and fast, even for accessing member-only pages.

I can't help but think that this double-authentication method could cause some loadtime issues in the future, as the site and its memberbase expands. This isn't an issue at present, although it's something I'm looking into.

What I'm interested to know is whether anyone knows of any security problems that could be caused by doing things this way rather than a more "conventional" method of handling user authentication? Has anyone done something this way in the past and hit problems?

Looking to the future, do people think that this method is likely to cause problems with access times, and can anyone suggest a better way of implementing this? I'm thinking about unique session IDs, that can be generated and validated in-code, without a call to the database being required.

I should point out that I'm not after something militarily secure - but I wouldn't like phone numbers of members and stuff like that passing out into the public domain.

I'm very interested to know any thoughts/comments/criticisms people have about this way of doing things .. and any suggestions would be appreciated.

Cheers ..
-- Foxcub

In reply to Security in CGI and User Authentication by Tanalis

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.