Re: Webpage Logins

[knobunc]

Beware using the IP address as a unique token for a session. Any users that go through a proxy will appear to come from the same IP. AOL users for instance rotate through a handful of IP addresses for each request.

The other replies have hopefully pointed you in the right direction.

Also, if you decide to store the information in a file make sure you lock it when updating and reading. Otherwise it will get corrupted at some point.

Updated: I had a chance to look at how I had coded the login stuff on my pages here. The relevant bit is to use Apache::Session which gives me an ID that I then stuff into a cookie. The IDs generated are relatively secure, they use all sorts of good random info then run it through an MD5 hash so I think they are unguessable. Anyway, onto the code:

use Apache::Session::File;
use CGI::Cookie;

use constant TIMEOUT     => 60 * 60 * 2;  # 2 hours
use constant COOKIE_NAME => 'MY_COOKIE';
use constant BASE_URL    => '/';

# Get the ID from the cookie (if one was set)
my $raw_cookie = $r->header_in('Cookie') || "";
my %cookies = parse CGI::Cookie($cookie);
my $id = $cookies{COOKIE_NAME};

# Get the session object from disk
my %session;
tie %session, 'Apache::Session::File, $id, {
    Directory     => '/tmp/state',
    LockDirectory => '/tmp/state',
};

# Set the cookie back if it was new
if (not defined $id) {
    my $new_cookie =
        new CGI::Cookie(-name  => COOKIE_NAME,
                        -value => $session->{_session_id},
                -path  => BASE_URL,
                );
    $r->err_header_out('Set-Cookie' => $new_cookie);
}

# Now just read and write things to the session object
# and they will get saved.  You have to be careful about
# any references though.  See the docs for details.

# Check to make sure the session is valid
my $cur_time = time;
unless (defined $session{last_access} and
        $session{last_access} < time - TIMEOUT and
    defined $session{valid} and
    $session{valid} == 1)
{
   # Illegal access, bump to the login page
   # It must make the session valid by setting the 
   # last_access and valid fields.
}
$session{last_access} = $cur_time;

Please note that this code will probably need to be changed to fit your web environment. I was using $r since my code comes from mod_perl. If you are using straight CGI then there is a CGI.pm thing to set the cookie stuff in the response header. The above may or may not work since I cut and pasted relevant bits from my setup (I am using Mason) and actually have stuff split up across subroutines because my data store and autentication is a bit more twisty.

-ben