[Xitami] Password protected Perl CGI.

[Thomas J. Hruska]

At 11:50 AM 8/13/01 -0400, David Michaels writeth:
>
>First part.  I have been searching for a simple way to password protect a
Perl CGI program.  (I'm using CGI.pm and DBI.pm).  I don't need heavy
authentication, just basic security - something to keep casual browsers
out.  Is there a Perl module that can supply this functionality?  If so, is
there a HOWTO?  If not, has anyone written a secure front-end (Perl or
HTML/CGI.pm) to a Perl CGI that they are willing to share?  I can see how
to do it without a libmod, but I think I'd just be re-inventing, and
probably not as well as someone who does this all the time.

Have you tried putting the CGI in its own directory and then modified your
Xitami configuration to password protect the directory?  This usually stops
most people from attempting to get it.  If someone tries to get it by brute
force or it is obvious in the logs that someone is doing something that you
don't want them to do, you can block the IP.

>Second part.  At this time, a user can bookmark this CGI location,
bypassing any password protection scheme.  Is there some way around this
using Perl and/or HTML?  I've seen this with forms using ASP or PHP but
haven't found it with Perl.  It seems to me that the CGI is static, and I
can't think of a way to keep it from being loaded if someone goes directly
to the page, unless the password code is an integral part of the code
itself - but this becomes a hassle for folks who are doing multiple entries
(20 -30) at one session.

Do some type of session-management-thingy...that way you can force people
to log in/enter a password to get into the system between browser
sessions/time limits (there are two types of sessions, sessions that
persist until the browser closes, and sessions that persist until time runs
out - some websites use both methods).

Hope this helps!


           Thomas J. Hruska -- shinelight@crosswinds.net
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/