Hello Monks.
I have a general question about usign CGI::Session for web page authentication.
I have a very simple web application that authenticates users based on a username and password they supply. The form checks this against the SQL db and if OK redirects them to a page. I would like to stop anyone just bypassing this page(s) by putting the direct URL in the browser.
Looking at CGI::Session I can generate a new CGI session id and pass this along via the URL or hidden forms (I need to assume no cookies will be saved/allowed at the client). I am having trouble with the mechanics of what needs to be done but I am thinking of the following:
On every page check for the existence of a cgi->param("sessionid")
if none exists redirect to the login page. Is this common practice?
The problem I have then is timing out the users session and/or stopping anyone logging in with the same id. (and I suppose someone adding a sessionID to URL).
Is it a good idea to, upon successful login, store the sessionid in the MySQL database and then on everypage check the existing sessionid is equal to the latest one in the db and if not kick them out?
Does anyone have any general thoughts, tutorials on this? I have read the CGI::Session, CGI::Session::Tutorial and CGI::Session::Cookbook and the code isn't really the problem, it's more the method I am struggling with.
Sorry for the long winded, generic question!
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.
|
