Skip to main content
S
StearmanDriver
Known Participant
February 11, 2009
Question

How (in)secure is this?

  • February 11, 2009
  • 2 replies
  • 616 views
Ok, I admit I'm pretty clueless when it comes to security. It's never been an issue in the few apps I've built. I've got one now though that requires basic login security. I want to run my idea by you guys and see how bad it is...

First off, I'm not securing anything all that important. No financial data, not much personal information. Nothing anyone could use for a scam or anything more malicious than putting people on a spam list. But I do want to keep different database tables somewhat secure, viewable only to the users who have the username and password for that section.

Here's what I'm thinking:
1. A master login page that takes a username and password, stores as session variables, then goes....
2. ...to a page that pulls the record that matches that username out of a database table. A cfif statement will also check the password to verify it matches. If the username and password session variables don't exist, or if the password doesn't match the password stored in the DB record for that username, cflocation back to the login page.
3. If the username and password DO match the info stored in that database record, cflocation to that user's folder of the website (that path stored in the database record). Every page in this folder (only a few) will have code that verifies that the username and password session variables exist, and that the password matches the value stored in the DB record for that username. If not, cflocation back to the login page.

This will be a mySQL database, and I will turn directory browsing off.

The main problem I see is that it won't really guard a user with a valid password from accessing an area of the site that isn't intended for him, if he knows the exact path to get there (which hopefully he can't figure out). I figure I could fix this by hardcoding in the required password and username values for that section, but I want a template I can use to create new user folders, without having to tweak the authentication code for each new folder.

So, pretty damn generic. With directory browsing off, is there an easy way that a non-hacker type of user could figure out the path to another user's section of the site?

Or, is there another easy way to do this that doesn't require code tweaks every time I set up a new section?

Thanks...
Joe
    This topic has been closed for replies.

    2 replies

    D
    Dan_Bracuk
    Inspiring
    February 12, 2009
    Storing passwords in plain text is bad. You should either encrypt or hash them. Which one depends on your forgotten password plan.
    S
    StearmanDriverAuthor
    Known Participant
    February 12, 2009
    Kapitaine, thanks for the suggestion of using Application.cfc. For some reason that didn't occur to me, but I have a system in my head now that should work in the Application.cfc file. Just curious - what's the advantage of wrapping my authentication code in cflogin? Since it exists I'm guessing there must be one. Instead of assigning roles to keep users in their section (since if the site grows, I still want to keep each user in their own folder, so the number of roles would just keep increasing), I'm just going to check if the requested page path contains the path to the user's folder specified in their database record. I'll name each folder uniquely, so if a user isn't in their folder the paths won't match and they'll bounce back to the login.

    Dan, thanks for the advice but you've overestimated my competence by a bit. I don't even know what either of those things mean! When you say storing a password in plain text is bad, do you mean in the database or in the page code, or in variables?

    Thanks,
    Joe
    D
    Dan_Bracuk
    Inspiring
    February 12, 2009
    quote:
    Originally posted by: StearmanDriver
    Dan, thanks for the advice but you've overestimated my competence by a bit. I don't even know what either of those things mean! When you say storing a password in plain text is bad, do you mean in the database or in the page code, or in variables?

    Thanks,
    Joe

    In the database.

    If someone hacks into your database they can see people's passwords. Many people re-use passwords because there are so many things that require them and one can only memorize so many.
    A
    Anonymous
    February 11, 2009
    Well, a good idea would be to use your application.cfc file.

    Seeing as the application.cfc file is the first thing to run before every request, it makes sense to validate things like this here. You can use some logic within the onRequestStart() method of the application.cfc file to check that, although a user may be logged in, they should not be able to view certain directories etc.

    For example, you might let them login to the app, but you don't want them looking at other folders etc, so you'd have something like:

    Psuedo Code
    --------------------

    if user is logged in and the template or path name is NOT listFindOrSomeKindOfThing(some, kind, of, list, here)
    then give access
    else
    cflocation to somewhere else...login page



    Good luck,
    Mikey.
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices