dlebowski Posted January 25, 2008 Share Posted January 25, 2008 I need some opinions on whether password protecting a directory is more secure than using a login script. My application would work just fine if I could password protect the directory. Would that be the way to go? Thanks in advance. Ryan Quote Link to comment Share on other sites More sharing options...
Stooney Posted January 25, 2008 Share Posted January 25, 2008 It would really depend on how it works and who uses it. .htpasswd is the easiest to use, but has limited functionality. using sessions with the proper security works just as well and has way more functionality. If it's just a small personal script it's your choice, but if it will be available to the public, I would say use sessions. Quote Link to comment Share on other sites More sharing options...
dlebowski Posted January 25, 2008 Author Share Posted January 25, 2008 It is a scenario where I basically create a directory manually for a new user and then dump the code into that directory. They would then browse to the URL provided and it's only for them. Each client gets there own URL. I would manually create the logins and passwords and create the URL once they sign up. I would assume that password protecting the directory would be more secure then sessions. Am I correct in thinking that? Thanks for the prompt reply. Ryan Quote Link to comment Share on other sites More sharing options...
Stooney Posted January 25, 2008 Share Posted January 25, 2008 It sounds like a standard site where users can log in. I'm sure most people would recommend sessions for this, but if you want to use .htpasswd then it would technically work fine. Also, with sessions you won't have to 'dump code' into each new directory. As for their custom url, you can use mod rewrite. Quote Link to comment Share on other sites More sharing options...
dlebowski Posted January 25, 2008 Author Share Posted January 25, 2008 I will look into mod rewrite. Thanks. I'm not sure how that would work with my app because there will be a ton of data that is stored in a DB and it is currently written so that each client gets their own database. Regardless, if this is something I need to do, I will look into it. Which is more secure? The current login script that I have does not appear to be all that secure and that concerns me and that is what prompted this post today. Ryan Quote Link to comment Share on other sites More sharing options...
dlebowski Posted January 25, 2008 Author Share Posted January 25, 2008 If I use .htaccess in conjunction with SSL, is that as secure or more secure than using sessions? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.