How would you implement FORM based authentication without a backing database?
authentication, cgi, cookies, http, php
Solution
A few ways you could do this.
- htaccess -- have your webserver handle securing the pages in question (not exactly cgi form based though).
- Use cookies and some sort of hashing algorithm (md5 is good enough) to store the passwords in a flat file where each line in the file is username:passwordhash. Make sure to salt your hashes for extra security vs rainbow tables. (This method is a bit naive... be very careful with security if you go this route)
- use something like a sqlite database just to handle authentication. Sqlite is compact and simple enough that it may still meet your needs even if you don't want a big db backend.
Theoretically, you could also store session data in a flat file, even if you can't have a database.
Problem
I have a PHP script that runs as a CGI program and the HTTP `Authenticate` header gets eaten and spit out. So I would like to implement some kind of FORM based authentication. As an added constraint, there is no database so no session data can be stored. I am very open to having a master username and password. I just need to protect the application from an intruder who doesn't know these credentials. So how would you implement this? Cookies? I could present the form and if it validates, I can send back a cookie that is a hash of the IP address come secret code. Then I can prevent pages from rendering unless the thing decrypts correctly. But I have no idea how to implement that in PHP.