Re: Re: Cookies problem

[vorteks]

Absolutely INCREDIBLE!!!! I can't thank you enough, it works a treat!

Whilst I said I've been using Perl for 18 months, It's on and off at work doing a website for our online tracking system and as you must know, If you leave it a while it's hard to get back into it.
I have some nasty little habits (no pun intended) and need to get out of them - One of them being to tidy up my coding.
I decided to use cookies as I was previously using .htaccess and users were having to enter the same user/pass many times whilst moving through various protected folders (this is another problem I could see no answer to).

Many thanks again for your coding, it's prompted me to open the books again and get learning all the little things I overlooked the last time.

Best regards

Tony

[sedhed]

Yes, when working on code in spurts it's always harder to get back into it. My job is half perl, half general system administration, and not split in even halves. :) It's both all day, interrupting programming time with floor calls and hardware problems all day long. It can make remembering where you were a chore...

Just a side note....You realize of course that just putting a username in a cookie is not at all secure. Anyone can fake a cookie with ease. So it's probably fine for a protected intranet app with trusted users, but if you're trying to keep unauthorized folks out of a public website, that's not going to do it. Your best bet if you need more options than .htaccess files is to look into the Apache::AuthCookie module. I use a subclass of it called Apache::AuthCookieDBI, and though it wasn't all that easy to get going, I love it now.

cheers!

[Phaysis]

I decided to use cookies as I was previously using .htaccess and users were having to enter the same user/pass many times whilst moving through various protected folders (this is another problem I could see no answer to).

Funny that I was just reading the Apache docs about this earlier today. If you're using Apache, and have the ability to set per-directory .htaccess (which I assume you do), look at: http://httpd.apache.org/docs/howto/auth.html#basicworks You can configure your various secured directories such that they are named under one authentication name, or "realm", to which browsers will send the same auth info on every request. This prevents the constant auth logins when changing directories.

Try adding the line:
AuthName "Our Protected Stuff"
to your .htaccess file and see what happens. I've not tried this, but will soon have a need for it. Let me know how well it works.

-Shawn
(P^h) Phaysis
If idle hands are the tools of the devil, are idol tools the hands of god?