SV650.org - SV650 & Gladius 650 Forum - View Single Post - How to create a Secure Website

31-03-08, 12:29 PM

Thanks for the responses peeps.

The site is going to be pretty basic. The number of pages probably won't exceed 20 - but I would like say 15 of them to only be available to an authenticated use. But it will 'only' be as complicated as if you're logged in you can see it all, if you're not you get the 1st 5 pages only.

I don't really expect it to get attacked\broken. For the inital site (the one that prompted me to look into this) it really wouldn't matter if it did. But if I can get my head round this then I can see more uses for it and it would be cool to do something for just me in the future so I could put a load of personal reference stuff up that is more easily accessible that using FTP or RDP.

I'd like to create the solution myself so that I've learned something. If I 'needed' a big\proper solution I woudl follow the advice of the pre done stuff (though I'd probably have just used something like Windows Sharepoint Services).

Does it have to be IIS? If it really mattered no - but this is a personal project and I'd rather have it on a platform I understand. If I was Linux\Unix familiar and knew Apache I'd be in a different job and earning more money

. As it is I'm a M$ monkey.

I found this page http://www.devarticles.com/c/a/PHP/C...-Login-Script/ in my searching. It seems to cover a lot of what I think I want. I'm just not quite sure how it plugs into things in the grand scheme of things.
I think that I need to:
* Create a login form - have certain info sent from that (ideally over HTTPS to actaully be secure but I'm not actually that fussed)
* Use some of the code shown to check this info against some stored in a MySQL db in an encrypted fashion (which is again good practise tho' a step more than I actually need)
* For each page I create have it run another bit of the code which checks (somehow - sessions and stuff I don't quite get) that the user is logged in - if they are it processes and present the page - if it doesn't dumps them out to a login page.

That mostly makes sense. The whole sessions and cookies thing appears to be black magic to me though.

31-03-08, 12:29 PM	#4
2mths Guest Posts: n/a	Re: How to create a Secure Website - Can anyone give me some pointers? Thanks for the responses peeps. The site is going to be pretty basic. The number of pages probably won't exceed 20 - but I would like say 15 of them to only be available to an authenticated use. But it will 'only' be as complicated as if you're logged in you can see it all, if you're not you get the 1st 5 pages only. I don't really expect it to get attacked\broken. For the inital site (the one that prompted me to look into this) it really wouldn't matter if it did. But if I can get my head round this then I can see more uses for it and it would be cool to do something for just me in the future so I could put a load of personal reference stuff up that is more easily accessible that using FTP or RDP. I'd like to create the solution myself so that I've learned something. If I 'needed' a big\proper solution I woudl follow the advice of the pre done stuff (though I'd probably have just used something like Windows Sharepoint Services). Does it have to be IIS? If it really mattered no - but this is a personal project and I'd rather have it on a platform I understand. If I was Linux\Unix familiar and knew Apache I'd be in a different job and earning more money . As it is I'm a M$ monkey. I found this page http://www.devarticles.com/c/a/PHP/C...-Login-Script/ in my searching. It seems to cover a lot of what I think I want. I'm just not quite sure how it plugs into things in the grand scheme of things. I think that I need to: * Create a login form - have certain info sent from that (ideally over HTTPS to actaully be secure but I'm not actually that fussed) * Use some of the code shown to check this info against some stored in a MySQL db in an encrypted fashion (which is again good practise tho' a step more than I actually need) * For each page I create have it run another bit of the code which checks (somehow - sessions and stuff I don't quite get) that the user is logged in - if they are it processes and present the page - if it doesn't dumps them out to a login page. That mostly makes sense. The whole sessions and cookies thing appears to be black magic to me though. Last edited by 2mths; 31-03-08 at 12:41 PM.