perleager has asked for the wisdom of the Perl Monks concerning the following question:

Hey, I built my whole entire member database through MySQL. My site will be displaying images only for the members section. The members section of my Web Site requires a username/pw thats stored in a MySQL database. Is this only a good setup for only sites that are not managing content for members. Any member can log-in, view a image thats only in the member section (no this is not an adult site), and copy and paste the address to anyother person to view.

Is there anyway to work around this? Such as using DBI to store the username/pw inside the NTFS members/users? ->I'm really not good with security or permissions so these questions might be a bit dumb. I'm using Windows, so its not like an Apache system where I can use .htaccess? -Or am I wrong about that too?

I also have HTML files that are generated from PowerPoint. If anyone has generated a powerpoint presentation into web page format, they know that theyre are a lot of files if there are a lot of slides. Each slide is a .htm file. These powerpoint presentations are only for members to view on the web. The solution I'm thinking to protect these html files is placing the .htm and presentation files (slide imgs) inside a directory not to be viewed by anyone through the web. Then in PERL, make a script verify the username/pw with DBI/MySQL that reads the .htm files and displays it in the browser. Is there any other security holes I may not know about doing it this way?

Any comments or suggestions on security for the situation im in will be nice ;)

Thanks,
Anthony
  • Comment on help with security info for web content

Replies are listed 'Best First'.
Re: help with security info for web content
by cLive ;-) (Prior) on Mar 24, 2004 at 01:02 UTC
    These may be assumptions, but here's my thoughts:
    • you're using query string information to hold the authentication info? bad idea
    • .htaccess files are the way to go if you just want to serve all content to valid users - and Apache works fine on windows if you have access to the machine.
    • you can use seperate .htaccess files in each subdirectory to limit user access further, but this can get messy
    • don't store passwords unencrypted in the database. at the very least, use crypt() to hide them, then compare a crypt of what the user enters as a password to what you have in the DB

    If you're going to wrap serving the files in a Perl script, use cookies (stored in DB with username) to validate rather than password lookup for each page request. Something like this:

    my $q=CGI->new(); if ($q->cookie('sessioncookie') { # check cookie exists in DB # serve page requested } elsif ($q->param('username')) { # check password OK, set session cookie # and store cookie in DB } else { # show login form }
    but it's hard to comment without seeing some code.

    .02

    cLive ;-)

Re: help with security info for web content
by iburrell (Chaplain) on Mar 24, 2004 at 01:03 UTC
    There are two ways to do authentication with IIS.

    First, is to use HTTP basic (or NTLM) authentication against the Windows user database. This can tied into the NTFS file permissions. This doesn't work well when you want to store the users in the database and not have them exist outside the database.

    Second, is to serve the content through a dynamic script. The script checks whatever mechanism you use to authenticate the users (ie cookie), and servers up the file. The URL can hide somewhat that there is a script: /files.cgi/some/dir/image.gif

    Apache gives other ways to do authentication. There are Apache modules that can do authentication in many different ways including basic against database, and with cookies. Also, you can write mod_perl auth handlers that run Perl code. Apache::AuthCookie uses cookies. Apache runs quite well on Windows but the mod_perl support is not production quality.

      Hey,

      thanks for the quick replies.

      I basically generate a session id and username and pass it through the scripts in the query. Each script would verify the session and username thats stored in the mysql db 'Members Online'. Is that considered bad security measures? Wouldn't this sort of be the same as using a cookie. Each content page would be PERL scripts displaying HTML and would still need some authentication coding, weither it be cookie or db authentication?

      Would you guys say choosing the Apache on Windows using .htaccess would be the safest way to go or cookies/db authentication is safe enough? These files that are for members aren't really top knotch files that need to be secured, but as I continue to learn PERL, I want to get to the point where I'm familiar with security in your Perl scripts that incase some job comes along that requires it, I'll be confident enough to do so.

      Also does anyone have suggestions on books for this type of subject?

      Thank you,
      Anthony
        >Also does anyone have suggestions on books for this type of subject?

        i can recommend a book published by o'reilly (who else?) about basic secure coding-prinicples.

        Secure Coding: Principles & Practices. it tells you a lot about what causes security wholes and how you can prevent them. but it does not show you specific code (that's why it's called 'principles').

        have fun!
Re: help with security info for web content
by rhxk (Beadle) on Mar 24, 2004 at 00:11 UTC
    First, having Windows itself creates a security hole.. :)

    However, there is Apache for windows where you can incorporate the .htaccess feature...

    If you're using ISS or IIS (which ever comes with windows), you can install apache to handle your familiarity with it.

    ...& that's my 2 cents...

Re: help with security info for web content
by DaWolf (Curate) on Mar 24, 2004 at 11:57 UTC
    Just my two cents about it:
    • Use sessions. Learn about them, it's a very useful feature for your case. Maybe Apache::Session can do the trick for you, maybe not (not sure if works on Win32). Anyway, search CPAN about it.
    • Another way of making unauthorized access hard is to test the HTTP_REFERER. This will tell you from where the user is coming to see the image, so you can restrain that the user must come from the image index page, for an example. Obviously you put a check in the image index page to see if the user is coming from the login screen.
    Hope that helps. Best regards,

    my ($author_nickname, $author_email) = ("DaWolf","erabbott\@terra.com.br") if ($author_name eq "Er Galvão Abbott");