Login system

[frizzle]

Hi Group,

I have a site with a MySQL backend. It has a member-system.
Members login with a small login-form that appears on every page
(via include())
If members are logged in, the form disappears and a few extra links
appear instead of the form.

- If members log in, i want to redirect them, if succesful, back to
the page they logged in from.
Should i use an extra hidden form-field with the
$_SERVER['request_uri'] or sould i use the $_SERVER['http_referer']?

- In both cases, how can i check that the referer is from MY domain?
if users login from http://domain.com/page.php i want to send them
back to that page, and not to http://www.domain.com/page.php and
vice versa.
How do i make sure they come from 1 of my own pages, and it's
accepted WITH and WITHOUT the 'www' prefix?

Thanks for any help!

Greetings Frizzle.

[Justin Koivisto]

frizzle wrote:

I have a site with a MySQL backend. It has a member-system.
Members login with a small login-form that appears on every page
(via include())
If members are logged in, the form disappears and a few extra links
appear instead of the form.

- If members log in, i want to redirect them, if succesful, back to
the page they logged in from.
Should i use an extra hidden form-field with the
$_SERVER['request_uri'] or sould i use the $_SERVER['http_referer']?

- In both cases, how can i check that the referer is from MY domain?
if users login from http://domain.com/page.php i want to send them
back to that page, and not to http://www.domain.com/page.php and
vice versa.
How do i make sure they come from 1 of my own pages, and it's
accepted WITH and WITHOUT the 'www' prefix?

In my project (sf.net/projects/phpsecurityadm) I've been using the
REQUEST_URI. If you use the referer, that's the page they came from, so
if they have the login bookmarked, then it will be blank. If they have a
proxy or firewall, that may be blank as well... If you use PHP_SELF,
then on a site that uses mod_rewrite or the like would have problems
since it isn't finding what it expects.

Basically, I have this set up in my login form generation:
if(isset($_SERV ER['REQUEST_URI'])){
echo ' <form method="post" action="',
$_SERVER['REQUEST_URI'],'">',"\n",
' <fieldset>',"\n ",
' <input type="hidden" name="PSA_REQ_U RI" value="',
$_SERVER['REQUEST_URI'],'" />',"\n";
}else{
echo ' <form method="post" action="',
$_SERVER['PHP_SELF'],'">',"\n",
' <fieldset>',"\n ",
' <input type="hidden" name="PSA_REQ_U RI" value="',
$_SERVER['PHP_SELF'],'" />',"\n";
}

This seems to have been working out well for me and other users.

--
Justin Koivisto, ZCE - ju****@koivi.co m
http://koivi.com

[frizzle]

Thanks for the reply!

Reading this, it seems to me, $_SERVER['REQUEST_URI'] isn't always set.
Isn't this a full server-side property?
I'm using mod_rewrite, so the second part of your code wouldn't be very
nice ... :(

Thanks!

Frizzle.

[Gordon Burditt]

>I have a site with a MySQL backend. It has a member-system.

Members login with a small login-form that appears on every page
(via include())
If members are logged in, the form disappears and a few extra links
appear instead of the form.

- If members log in, i want to redirect them, if succesful, back to
the page they logged in from.
Should i use an extra hidden form-field with the
$_SERVER['request_uri'] or sould i use the $_SERVER['http_referer']?
http_referer is sent from the browser, so it can't be trusted.
Also, many people turn it off or send nonsense for it. Some people
may not be able or willing to easily turn it back on for your site.
Use your hidden field. You have much more control over it.
- In both cases, how can i check that the referer is from MY domain?
Well, if it's just a random link, it probably won't have your hidden
form-field with the place to go back to listed. isset($_PUT['go_back_to'])
might be useful to test this.
if users login from http://domain.com/page.php i want to send them
back to that page, and not to http://www.domain.com/page.php and
vice versa.
How do i make sure they come from 1 of my own pages, and it's
accepted WITH and WITHOUT the 'www' prefix?

Parse the URL. If it's www.domain.com, change it to domain.com.
If it's not on a list of domains that are "yours", or not http or
https, or the field is missing entirely, send them to your home
page or someplace default. You could have a complete list of all
acceptable URLs where you have these login forms, but that's probably
too much work and not worth it. Just checking the domain is probably
enough.

Gordon L. Burditt

[Justin Koivisto]

frizzle wrote:

Thanks for the reply!

Reading this, it seems to me, $_SERVER['REQUEST_URI'] isn't always set.
Isn't this a full server-side property?
I'm using mod_rewrite, so the second part of your code wouldn't be very
nice ... :(

It depends on the server software you are using. For instance, IIS
doesn't have it:

http://koivi.com/apache-iis-php-server-array.php

--
Justin Koivisto, ZCE - ju****@koivi.co m
http://koivi.com

[frizzle]

@Gordon
I don't completely inderstand the next part:

"Well, if it's just a random link, it probably won't have your hidden
form-field with the place to go back to listed. isset($_PUT['go_back_to'])
might be useful to test this. "

I understood that i should use the hidden field, but could you please
try to explain (with other words) what you mean with that part?

@Justin,
I have the $_SERVER['REQUEST_URI'] implemented in some parts of the
site already. And it always works AFAIK ...
Could there be certain circumstances on my site that would have it to
fail?

Thanks a bunch guys!

Frizzle.

[Justin Koivisto]

frizzle wrote:

@Gordon
I don't completely inderstand the next part:

"Well, if it's just a random link, it probably won't have your hidden
form-field with the place to go back to listed. isset($_PUT['go_back_to'])
might be useful to test this. "

I understood that i should use the hidden field, but could you please
try to explain (with other words) what you mean with that part?

@Justin,
I have the $_SERVER['REQUEST_URI'] implemented in some parts of the
site already. And it always works AFAIK ...
Could there be certain circumstances on my site that would have it to
fail?

Sure, if you move the site to a non-apache server... If you don't plan
on moving it, you should be OK since that is an apache environment variable.

--
Justin Koivisto, ZCE - ju****@koivi.co m
http://koivi.com

[frizzle]

I'm definetly not moving the site! :D

Another thought: if the $_SERVER['http_referer'] is quite easy to fake,
would a hidden field with $_SERVER['REQUEST_URI'] be even more easy to
fake?
I'm assuming the members WANT to login. Username & pass are checked
from the DB, so if either referer, username or pass don't match, the
user cannot login (as it is now). is there anything wrong with this?

Now i'm also using the $_SERVER['http_referer'] for the logout action.
It doesn't contain a form, but only requests a page that destroys some
$_SESSION vars. This way i can send them back to the last page where
they were logged in.

Am i doing something wrong here then?

Frizzle.

[Gordon Burditt]

>@Gordon

I don't completely inderstand the next part:

"Well, if it's just a random link, it probably won't have your hidden
form-field with the place to go back to listed. isset($_PUT['go_back_to'])
Oops. That should be isset($_POST['go_back_to']).
might be useful to test this. "I understood that i should use the hidden field, but could you please
try to explain (with other words) what you mean with that part?

If you have a hidden field in your login form, say:
<input type="hidden" name="go_back_t o" value="http://www.domain.com/foo.php">
(the value part will be generated from some variable like
$_SERVER['REQUEST_URI'])

on all of your login pages, then when the user clicks the SUBMIT button,
you will have "http://www.domain.com/foo.php" in $_POST['go_back_to'].
If someone else sets up a non-form link, $_POST['go_back_to'] will
be empty. A quick but unreliable way to test if one of your forms
was used is to test isset($_POST['go_back_to']). This should have
no false negatives (your login forms *ALWAYS* have the hidden field).
There might be false positives. So if that variable isn't set,
it DEFINITELY isn't one of your login forms.

Someone CAN copy the HTML for your login form and set it up on another
server.
@Justin,
I have the $_SERVER['REQUEST_URI'] implemented in some parts of the
site already. And it always works AFAIK ...
Could there be certain circumstances on my site that would have it to
fail?

Gordon L. Burditt

[Gordon Burditt]

>Another thought: if the $_SERVER['http_referer'] is quite easy to fake,

would a hidden field with $_SERVER['REQUEST_URI'] be even more easy to
fake?
Probably not. Someone trying to DELIBERATELY fake is going to
succeed (without trying particularly hard). But many people running
security software, including those that block HTTP_REFERER, block
it without realizing it, and it may be darned inconvenient to NOT
block it. Also, something as simple as bookmarking a page and going
back to it will mess up HTTP_REFERER, and the user doing it may
have no idea why his login didn't work.

Remember, it is always possible for a user to (a) copy your HTML to
another server and edit it all he wants, or (b) manually type in
HTTP requests using telnet (or perhaps more conveniently, using CURL).
I'm assuming the members WANT to login. Username & pass are checked
from the DB, so if either referer, username or pass don't match, the
user cannot login (as it is now). is there anything wrong with this?
The referer stuff shouldn't be a *security* issue. As you described
it, it's a *convenience*. IMHO, if they give you an invalid referer
(remember, some users can't UNblock it), but a valid username and
password you should pick some reasonable default place to send them
(home page? ok. www.nambla.org? please don't.) after they've
logged in, and send them there. I think it's overly anal-retentive
to refuse a login here. It's much like not letting anyone with a
video display less than 65,000 colors and less than 20/20 vision
see your photographs AT ALL because they don't look their absolute
best, so you subject them to mandatory eye tests.

Why, incidentally, do you even want to refuse to send them back to
the page they logged in from if it's not yours? Sounds like
pretty obnoxious behavior.

Now i'm also using the $_SERVER['http_referer'] for the logout action.
It doesn't contain a form, but only requests a page that destroys some
$_SESSION vars. This way i can send them back to the last page where
they were logged in.

If you can't send them back to the last page where they were logged
in because the URL looks invalid, pick some place to send them
and send them there. Your home page, perhaps.

Gordon L. Burditt