Re: PHP and user login stuff

["Aaron D. Turner" <aturner@pobox.com>]

-----BEGIN PGP SIGNED MESSAGE-----


On Wed, 17 Feb 1999, Jason Pincin wrote:

> > Hmmm, on second thought maybe a password in the URL (encrypted or not)
> > isn't necessarily a good idea.
> 
> No.  It's not a good idea.  That stuff can still be snarfed and used,
> encrypted or not.

This is a good reason to use Apache::Session module for perl.  You can
also do it via hidden attributes in the page.  The Perl Jornal also has a
total writeup of code that does this with mod_perl too.  We'd need to make
some modifications to the code, but it would work without cookies and
without the need for the person to log in each time.  It would also be
reasonably secure, though not hacker proof, though I don't think we need
hacker proof anyways.
 
> > 
> > Basically, it's either
> > 1.  This (which requires all pages be generated dynamically)
> 
> Don't like that.

Because?  It's not a big deal.  Load wise, the number of submissions will
be static compared to people reading the content.  Or use embperl which
allows you to embed perl in HTML docs, sorta like PHP3.
 
> > 2.  The user enters handle/passwd EVERY time they do something requiring
> > it
> 
> Like that if they choose not to use cookies.  It's not so bad.  Your not
> going to have any one user running around commenting on dozens of
> articles... and you don't need to login to say wether or not an article
> helped you out.  If someone wants to spend an afternoon and make comments
> on 50 articles, I'm sure they would consider a temporary cookie.

See above.  BTW, perl has a nice cookie interface that hides all the
ugly aspects of cookies from the coder.

> > > I think it's desirable to impliment both.  If Micah doesn't want to impliment the
> > > cookie method now, thats fine, but at some point I'd want to go back and impliment
> > > it.  Thats up to Micah.  Just like you'll have some users complain about
> > Good idea - I'll probably start with what I described, then we can add
> > and/or change it later.
> 
> Yeah... to make sure we're on the same page... I was thinking you just
> impliment the method that requires a sign in everytime since it'd be
> easiest... and re-usable once cookies are implimented... cuz we'll still
> need it.
> 
> That is unless your further along with another method.  I was just curious
> as to exactly what method you'll be doing first.

I haven't done a thing.  Right now I'm more worried about the big picture
and figuring out a good way to keep ht:dig happy for each CVS module.  

Learned long ago figure out where you're going before you try to get
there.  If we change what we're doing later on, fine, but at least start
out thinking you know. :-)

> Let me know, I'm excited :)
> 
> > Also, the signup form is coming along.  There are a couple problems with
> > it that I'm trying to debug.  It's in my home directory now, in
> > public_html

One comment, drop the <font size=+X> those statements aren't useful in
lynx.  Use <H1>,<H2>,etc instead.  Also we need to come up with a standard
look and feel. Colors, positions, format, that sort of thing.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNs3mEzM3jpXy1kJtAQGPbwP+P1a8Ai0kGQu0yOQc+xOpPblkuM+u1Tuy
J1lnMGN62dxXwTcyoHTQG5gQ3sbemUxEltFGyzIun6FcbbDe02sc8Ubs6ATC6xY6
Gtvq9vvTgSd7qz5ab8Zi0Q2fvJhFE7Tyu8p81ica86nSE/YMBJO3Dxz3GiWA+AC6
toUgrS249tA=
=/8Dn
-----END PGP SIGNATURE-----