Posted: Fri Feb 05, 1999 10:26 pm Post subject: Dynamically generating .htaccess
howdy.
I manage a site which authenticates users by IP address. However, the flat text file is beginning to slow down Apache (having to parse the file each time you need to authenticate).
I was curious on whether the .htaccess file could dynamically generate an allow from statement using PHP and mysql. I have mod_auth_mysql installed, but, it only supports user/password authentication. I would like to have the htaccess parse the database based on the users' host address, if it returns a match then generate an allow from statement for that address in the .htaccess file, if it fails send a 403.
Posted: Sat Feb 06, 1999 8:09 pm Post subject: RE: Dynamically generating .htaccess
First let me say that IP as an authentication method is really bad. Practically anyone can pretend to come from any IP he wishes.
I really dont see your problem. At the begining of each page or just at the main page you should run a simple function that checks the person's IP against the DB.
Whats not clear is who manages the DB? why can't he just manage the .htaccess file?.
I guess you can chcnge the .htaccess file on the fly but than you have a security issue cause "nobody" has write access to your .htaccess file.
I'm not familiar with your system but i'm sure it can be set up to work diffrently in all that concerns authentication.
Posted: Sat Feb 06, 1999 8:10 pm Post subject: RE: Dynamically generating .htaccess
One more point, if "nobody" allready has access to the .htaccess file (to change it) he has access to the rest of the directory as well so what does that help?
Posted: Mon Feb 08, 1999 9:03 am Post subject: RE: Dynamically generating .htaccess
First let me say that IP as an authentication method is really bad. Practically anyone can pretend to come from any IP he wishes.
----------->
Yes.. agreed, however, we are providing site licenses to elementary schools, and, management of login/password combinations with that client base would be a nightmare =)
------------>
I really dont see your problem. At the begining of each page or just at the main page you should run a simple function that checks the person's IP against the DB.
------------->
Thanks. amazing how the easy solution evades you sometimes. =)
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum