I am currently wondering how a centralized page authenticator could be achieved. Can anyone suggest a neat algorithm for me? What I intend to achieve is to make my backend administrator pages session protected without writing a piece of session checking code to each of my pages that I want protected. I currently do something like this:
login page -> if right credentials : set session -> if view protected page without session : reject else : permit
Any best practices (or a better method) on/than this?
I would not so much want to suggest an algorithm, but a library/framework instead.
If your application has a single entry point, that is the place to call your session management library/framework. For example with the Zend Framework you can initiate your session in the bootstrap. The only thing left is to authenticate a session in the login controller.
If you're architecting a PHP app that has multiple entry points you will go crazy trying to copy and paste all this code. Look into using a real MVC framework.
I use Zend_Controller to route my pageviews in situations like this.
Once you architect your app in that way, it becomes simple to add some code to the predispatch() method of your restricted controllers to do authentication and redirect to a login page if it is not found or is invalid.
Related
The documentation doesn't talk much about logging in and out and handling security in general.In Symfony, you can secure pages of your site via a YML file. Does F3 have anything like that?
What is the recommended way to secure pages and handle a logged in user? I liked basic Auth, but it isn't very flexible, and it seems logging out is trickier. So I decided to set up a form for login/logout.
I would have assumed that Auth automatically creates a session, but from what I can tell it doesn't. So does that mean I need to manually do it?
Also, how do I block non authenticated visitors from the site? Do I need to add a SESSION check in each route?
The freedom when using F3 is that you can/must implement this on your own.
You got multiple options here or can create some other creative solutions too, if your project requires it. The included Auth plugin doesn't create a SESSION of course, because it cannot know if you want to use a SESSION to track your users or maybe use other solutions (cookie, JWT, etc).
So in most cases you need to create an Auth controller where you check if a user is logged in or not - here you would probably use the Auth plugin and create the SESSION if you want that. From there on you got serveral other options.. just to name a few:
use a base controller, that your other controllers will extend (or a Trait) and add a beforeroute there, where you'll check if the user is logged in and allowed to access that ressource.
check the user rights in the front controller (index.php) and don't even register the routes that the user has no access to.
use a 3rd party plugin to add access checks to routes, i.e. f3-access
use another middleware router to pre-flight the current request and add auth checks to multiple routes at once
Basically, in general web application with php we used to check session through calling php script in that particular html page.
But as I am working in Integration of application i.e. Angularjs and Laravel, I m not getting how can I achieve above said thing in this application.
Please guide me for this.
Thanks in Advance.
Sessions are handled by Laravel automatically. The session data is stored in cookies. It doesn't depend on your JS framework
If you want to check if the User has logged in, use this:
if (\Auth::check())
{
// The user is logged in...
}
The title says most of it, but is there a way to link from a page in the front end to a component in the backend WITHOUT asking the user to login again. Some thoughts come to mind, Sessions tables, and cookies, but I'm just not sure how to go about doing it. Any suggestions?
Joomla! runs as two separate applications, one for the front-end and one for the back-end.
To do what you're suggesting is problematic:
Any system you implement to get this working could compromise site security.
You would have to find/build a mechanism that logs the user into both the front-end and back at the same time.
As both back-end & front-end use different tokens and sessions you would also have to keep both of those alive as well.
As part of this process your software should probably limit back-end auto logins to those with the right permissions as well.
I'm not aware of any extensions that do what you want but there are some that allow some backend functionality in the front-end - you can look in the "Site Access" section of the JED.
Why not just add a frontend view for the component you want to display? For example like this.
I'm having a hard time understanding how the CakePHP admin system works.
Should all controllers who has an action which requires login include AuthComponent or just the one who handles the login/logout?
Let's say I want to protect the add action of a controller. First I create admin_add() in the controller and then in the beforeFilter() method I check if $this->Session->check('Auth.User') is set a redirect based on this? Turns out it was better to just controll this with $this->Auth->allow()
What is the easiest way to return to the URL the user was trying to access? Is there a better way than setting a session variable? Turns out it does this automagically :)
If someone has a good tutorial for this I would happily read it :)
I've already read this tutorial but I found it to be a little to basic and the CakePHP-docs are not that great on this topic either.
There is no Cake admin system as such. There is Authentication component and there is Access Control List component. You can use only Authentication component if you wish or you can use both of them. If you want to create your admin system from scratch follow this tutorial. Or you can try already created admin panel - PoundCake Control Panel.
we have created an admin system for cakePHP, works similar to the scaffolding but it's configurable and ready to deploy, check it at http://browniephp.org
You can learn a lot from others codes, specially something like CakePHP Admin plugin at: https://github.com/Maldicore/Admin
I am developing the ability for administrators to log in and I'm to the point of creating the admin log-in page, but I'm somewhat torn as to where the best place to put it.
For details, this is part of an MVC framework, and the administration portion is in it's own folder - /admin; so administration is completely separate from the public portion of the site.
I would like to place the actual log-in page in its own php file for security by separating it from the rest of the site. That way if they bust one, they don't bust all. However, then you get to the point of processing the log-in request - should it be in the same PHP file as the log-in, or should it reside in another file, or should all of this just be part of the framework?
Any suggestions would be much appreciated.
EDIT: just for some clarification, this is my first time creating any sort of user system, so please bear with me :) (Any good tutorial/example links are greatly appreciated too).The admin portion of the site is in it's own folder but uses the same base files, classes, etc as the front end - the files are only overwritten in the admin portion as needed. Also, an 'admin' is just a certain user type - roles and permissions have already been figured out.
I'm just having a hard time starting - particularly where to implement/put the login form. I thought it would be best for security to have a physically separate file for login, but I see that might not be the case.
I agree with the rest of the posts, Admin should be in the same work-flow. Here is a good example to reference.
Using the same login system for both admin and users will enable you to simplify your application. First off, you'll only need to create one login form. Secondly, if the admin section is part of the same codebase, you'll gain a huge benefit from being able to access all of the classes used throughout the site. If you used an MVC architecture, you'll probably want to use the same models in the admin as you do on the site. Even if you didn't, there is probably still a lot of code you can reuse for the admin section (base classes, database abstraction layer, shared settings/configuration, etc).
IMHO, Admin should login through the same form as regular user, but permissions should allow him to view additional content.
You can place admin forms in any folder, and then allow admin to access it.
I think the admin user should just be another class of user (or be an option for a normal user). Take note that there's slightly more chance of granting access to a normal user by mistake with this approach.