Adding authentication to your website

Page Protection

© utemov, Fotolia

© utemov, Fotolia

Article from Issue 96/2008
Author(s):

Apache offers several options for adding a password-protected area to a website.

If you want to offer login access to restricted web pages, you don't need a MySpace account or a big corporate website. Apache provides several convenient alternatives for supporting user authentication. Although these login options require a few extra configuration steps, you can easily protect your pages without the need for add-on, proprietary applications. In this article, I will describe some techniques for password-protecting your pages.

The Apache web server goes through three phases to determine whether the current user is allowed to view the requested resource. The Access phase checks to see whether the requesting IP address is allowed to view the resource. The Authentication phase verifies that the username provided matches the password associated with the user. The Authorization phase is usually used to support user groups for easier administration. With a bit of custom coding, I will explain how you can extend any of these phases to do whatever you want.

Unless your connection is over SSL, all of these methods will send your password in the clear. Using SSL for all pages that require authentication is highly recommended.

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • One-Time Passwords on the Web

    Add security to your website with a one-time password system.

  • XSA Attack

    A new form of phishing attack deposits an HTML tag on the vulnerable service to trap users into authenticating.

  • Liferay CMS

    Liferay is a powerful and easily customizable CMS that is ideal for community collaboration – once you get it configured.

  • FreeIPA

    FreeIPA offers integrated identity management and big ideas for the future.

  • Anubis

    The Anubis mail manipulation daemon lets you centralize encryption for outgoing mail.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News