I have a general question about usign CGI::Session for web page authentication.
I have a very simple web application that authenticates users based on a username and password they supply. The form checks this against the SQL db and if OK redirects them to a page. I would like to stop anyone just bypassing this page(s) by putting the direct URL in the browser.
Looking at CGI::Session I can generate a new CGI session id and pass this along via the URL or hidden forms (I need to assume no cookies will be saved/allowed at the client). I am having trouble with the mechanics of what needs to be done but I am thinking of the following:
On every page check for the existence of a cgi->param("sessionid")
if none exists redirect to the login page. Is this common practice?
The problem I have then is timing out the users session and/or stopping anyone logging in with the same id. (and I suppose someone adding a sessionID to URL).
Is it a good idea to, upon successful login, store the sessionid in the MySQL database and then on everypage check the existing sessionid is equal to the latest one in the db and if not kick them out?
Does anyone have any general thoughts, tutorials on this? I have read the CGI::Session, CGI::Session::Tutorial and CGI::Session::Cookbook and the code isn't really the problem, it's more the method I am struggling with.
Sorry for the long winded, generic question!