Please check my auth login script

[J. Frank Parnell]

The goal here is to use basic authentication for a user to log in, but keep a
cookie so that they dont have to log in every browser session.

<?
$user = "user";
$pass = "pass";

if(($_COOKIE['user']!=$user) OR ($_COOKIE['pass']!=$pass)){
if (
(!isset( $_SERVER['PHP_AUTH_USER'] )) OR
(!isset($_SERVER['PHP_AUTH_PW'])) OR
( $_SERVER['PHP_AUTH_USER'] != $user ) OR
( $_SERVER['PHP_AUTH_PW'] != $pass )
) {
header( 'WWW-Authenticate: Basic realm="test"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
exit;

}
}
if ( ( $_SERVER['PHP_AUTH_USER'] == $user )AND( $_SERVER['PHP_AUTH_PW'] ==
$pass))
) {
setcookie("user", $user, time()+99999, "/");
setcookie("pass", $pass, time()+99999, "/");

}

echo '<pre>cookie:';
print_r($_COOKIE);
echo "<BR>";
echo 'auth-user: '.$_SERVER['PHP_AUTH_USER'];
echo '<BR>auth-pass: '.$_SERVER['PHP_AUTH_PW'];
?>

thanks for the look

[Rik Wasmus]

On Fri, 06 Jun 2008 00:40:15 +0200, J. Frank Parnell <po*@edgecity.ufo
wrote:

The goal here is to use basic authentication for a user to log in, but
keep a
cookie so that they dont have to log in every browser session.

<?
$user = "user";
$pass = "pass";

if(($_COOKIE['user']!=$user) OR ($_COOKIE['pass']!=$pass)){
if (
(!isset( $_SERVER['PHP_AUTH_USER'] )) OR
(!isset($_SERVER['PHP_AUTH_PW'])) OR
( $_SERVER['PHP_AUTH_USER'] != $user ) OR
( $_SERVER['PHP_AUTH_PW'] != $pass )
) {
header( 'WWW-Authenticate: Basic realm="test"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
exit;

}
}
if ( ( $_SERVER['PHP_AUTH_USER'] == $user )AND( $_SERVER['PHP_AUTH_PW']
==
$pass))
) {
setcookie("user", $user, time()+99999, "/");
setcookie("pass", $pass, time()+99999, "/");

}

echo '<pre>cookie:';
print_r($_COOKIE);
echo "<BR>";
echo 'auth-user: '.$_SERVER['PHP_AUTH_USER'];
echo '<BR>auth-pass: '.$_SERVER['PHP_AUTH_PW'];
?>

Anything wrong, or do you just want input?

If the latter:
0) Don't use short tags (use <?php ?instead of <? ?>).
1) I'd hate to store plain passwords in cookies at the users computer,
which not only usually are stored plainly on the HD there, but are also
send on _every_ request. I usually create a hash unrelated to user/pass
details, and store that as valid for that user(-id), if that's to much you
could encrypt a pass + a secret using some of the available encryption
techniques used in PHP.

2) I have long ago decided against HTTP authentication 'cause save for
closing the browser or deleting ALL remembered passwords, there is no easy
way to log out for the user in most common UA's. Sessions & a simple
loginform are IMO the way to go.

.... then again, I'm so used applying only this technique I might not be
able to make an unbiased comment, it's what I know best :)
--
Rik Wasmus
....spamrun finished

[The Hajj]

On Jun 5, 6:40 pm, J. Frank Parnell <[e-mail]:

The goal here is to use basic authentication for a user to log in, but keep a
cookie so that they dont have to log in every browser session.

<?
$user = "user";
$pass = "pass";

if(($_COOKIE['user']!=$user) OR ($_COOKIE['pass']!=$pass)){
if (
(!isset( $_SERVER['PHP_AUTH_USER'] )) OR
(!isset($_SERVER['PHP_AUTH_PW'])) OR
( $_SERVER['PHP_AUTH_USER'] != $user ) OR
( $_SERVER['PHP_AUTH_PW'] != $pass )
) {
header( 'WWW-Authenticate: Basic realm="test"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
exit;

}

}

if ( ( $_SERVER['PHP_AUTH_USER'] == $user )AND( $_SERVER['PHP_AUTH_PW'] ==
$pass))
) {
setcookie("user", $user, time()+99999, "/");
setcookie("pass", $pass, time()+99999, "/");

}

echo '<pre>cookie:';
print_r($_COOKIE);
echo "<BR>";
echo 'auth-user: '.$_SERVER['PHP_AUTH_USER'];
echo '<BR>auth-pass: '.$_SERVER['PHP_AUTH_PW'];
?>

thanks for the look

I agree $_SESSION is the way to go, just had this discussion again at
work and I was in favor of a small client cookie to band aid and old
script we have, my coworker talked me out of it :(

I have a simple but probably overly complex OOP login script that uses
session if you would like to look at it? (it does more) I'd be happy
to email it to you.

[J. Frank Parnell]

On Fri, 06 Jun 2008 09:04:08 +0200, "Rik Wasmus" <lu************@hotmail.com>
wrote:

>On Fri, 06 Jun 2008 00:40:15 +0200, J. Frank Parnell <po*@edgecity.ufo>
wrote:

>The goal here is to use basic authentication for a user to log in, but
keep a
cookie so that they dont have to log in every browser session.

<?
$user = "user";
$pass = "pass";

if(($_COOKIE['user']!=$user) OR ($_COOKIE['pass']!=$pass)){
if (
(!isset( $_SERVER['PHP_AUTH_USER'] )) OR
(!isset($_SERVER['PHP_AUTH_PW'])) OR
( $_SERVER['PHP_AUTH_USER'] != $user ) OR
( $_SERVER['PHP_AUTH_PW'] != $pass )
) {
header( 'WWW-Authenticate: Basic realm="test"' );
header( 'HTTP/1.0 401 Unauthorized' );
echo 'Authorization Required.';
exit;

}
}
if ( ( $_SERVER['PHP_AUTH_USER'] == $user )AND( $_SERVER['PHP_AUTH_PW']
==
$pass))
) {
setcookie("user", $user, time()+99999, "/");
setcookie("pass", $pass, time()+99999, "/");

}

echo '<pre>cookie:';
print_r($_COOKIE);
echo "<BR>";
echo 'auth-user: '.$_SERVER['PHP_AUTH_USER'];
echo '<BR>auth-pass: '.$_SERVER['PHP_AUTH_PW'];
?>

Anything wrong, or do you just want input?

Just input :) I was basically wanting to know if i had left any holes in the
script, or if there were reasons that the script was less than optimal, like...

>1) I'd hate to store plain passwords in cookies at the users computer,
which not only usually are stored plainly on the HD there, but are also
send on _every_ request. I usually create a hash unrelated to user/pass
details, and store that as valid for that user(-id), if that's to much you
could encrypt a pass + a secret using some of the available encryption
techniques used in PHP.

I dont ususally have reason to belive that the users computer will be physically
stolen and spyed on, but good point none the less.

The cookie being sent on every request is bad why? because that gives more
chance for an eavesdropper to see them? again, point taken.

The cookie is the main reason for this script, just to save the user from loggin
in every time. But, because of your concerns, i may just tell him to deal with
it :)

>
2) I have long ago decided against HTTP authentication 'cause save for
closing the browser or deleting ALL remembered passwords, there is no easy
way to log out for the user in most common UA's. Sessions & a simple
loginform are IMO the way to go.

logging out is not really a concern, as of yet.

Thanks for your time and comments, theyre appreciated.

[J. Frank Parnell]

On Fri, 6 Jun 2008 03:24:03 -0700 (PDT), The Hajj <ha***********@gmail.com>
wrote:

>On Jun 5, 6:40 pm, J. Frank Parnell <[e-mail]:

>The goal here is to use basic authentication for a user to log in, but keep a
cookie so that they dont have to log in every browser session.

>
I agree $_SESSION is the way to go, just had this discussion again at
work and I was in favor of a small client cookie to band aid and old
script we have, my coworker talked me out of it :(

I have a simple but probably overly complex OOP login script that uses
session if you would like to look at it? (it does more) I'd be happy
to email it to you.

I'd like to have a look-see, that would be great. dddougxxx at the mail that
google provides.

I have downloaded and played with http://www.phpsecurepages.com/ Is yours
similar?