PHP - Server Authentication

Hi folks,

I'm curious if I can for example, save a file from my server and it will save to all other servers - obviously if they accepted the connection first. It's for a software I developed and is almost complete and know there will be frequent updates to it. Instead of users downloading upates, I want the update files from my server to somehow synchronize to their server automatically?

Anything called this??

Thanks for info.

Following a tutorial on udemy, i tried to learn the very basics of mvc structure. I built the same project on my local server and it worked without giving me any error. but when i tried it on live server. its not working as it should. not showing any error. I tried to figure out the problem and found that for every page loading, it stops at the same line in my main.php file.

<?php require($view); ?>

starting from the above line. it stops. i came here to share my problem but i am unable to upload my files here. if there is a way to upload and share my files, please guide. zip file size of the whole project is 31.6 kb

This isn't exactly an application design question, but rather a system design one.   I am about to install an Inventory Control System inside this store I work in.   The store itself also owns a Linode VPS running Centos 6.4 which hosts our website.   This new Inventory System will come built in with a Microsoft SQL Server, and supposedly it is a SQL Anywhere database, but I'm not too sure what that means.     I need to make this database publicly accessible, but only via the Linode VPS.  Surely, setting restrictions is easy enough to address that issue.  That isn't my question.   My first idea is to put this server into the DMZ, easy.  But it doesn't exactly sound safe.  So my next idea was to put a middleman server in the DMZ, this way the Linode can send queries to that middleman server and it will send that data to the SQL Server and back.  This is very vaguely described I know, but I don't want to get too much into details, but rather, understand how I can create that middleman server, and what could Install onto it that would allow me to securely process queries?   My first thought was to install a webservice, that accepts an XML/JSON request and returns an XML/JSON response. Then, I realized directly afterwards that I don't have any experience setting up a webservice like that. What kind of options are there out there?
  Ultimately, my question is, should I just put the Server in the DMZ or should I create the middleman, and if so, can someone point me in the right direction as to getting a webservice set up?
Edited by Zane, 15 July 2014 - 11:28 PM.

I am currently doing the following but wish to change to using JWTs.

A webserver is running some CRM system which has its own authentication system and browsers can access public routes without logging and but must log on first to access private routes. All the routes on the webserver which are prefixed by "api" will be forwarded to specific REST API along with an "account" GUID in the header and the user's ID if it exists. For the routes that require a user to be logged in, the webserver will first check if a session exists, and if not make a preliminary GET request to the REST API which includes the GUID as well as the user's ID and encrypted password (both based on the webserver's CRM DB) in the URL.  Not sure whether anything is possible by including the hashed password and am currently not doing anything with it.  The REST API queries the DB using the GUID and webserver's user ID and returns the REST API's users ID and the webserver stores it in a session. The REST API receives the GUID and potentially the REST API's user ID and queries the DB to retrieve the account and potentially user before executing the route, and returns the response to the webserver which it returns it to the browser.

The new approach might be something like the following:

Before the webserver forwards any request to the REST API, it checks if a session is set, and if not performs a GET request to the REST API along with the GUID and if known user's credentials in the URL and receives a JWT which contains a payload including the account PK, and potentially the user PK, user's access level, etc. All future requests include this JWT in the header. The REST API no longer queries the DB to get the account ID and user authorized settings as it is provided in the JWT.

A couple of questions:

What should be done if a non-logged on user first accesses a public route, gets a JWT, and stores it in a session, but then later logs on and accesses a private route?  The webserver thinks it has a valid JWT and will send it but the REST API will then decrypt it and find there is no user it.  One option is for the webserver to use two sessions, but this sounds kludgy.  Or maybe the REST API returns some header which instructs the webserver to re-authenticate, but not sure if even an option, and if so how to cleanly prevent some loop.  Also, would it be necessary to issue a new JWT or can the payload in a JWT be changed? Is GET appropriate for requesting the JWT's or should I use some other method? Is it appropriate to include the user's access level in the JWT payload?  Will one need to wait until the JWT has expired before their access level changes? Any ideas how to deal with using the user's password on the CRM to also authenticate on the REST API?  The GUID is probably secret enough for the application and if an issue, can just use the GUID and username. Am I going down an reasonable path and anything else obvious I should be considering?

Thanks!

Hi all,

I have an authentication part on my website that checks every page through a session variable if a user is logged in and which user it is.
When I test my code on my computer it works perfectly registration and login goes smooth but when someone on another computer tries it they get the acces denied page.... does anyone know why???

Greets Ryflex

I have had a problem with people attacking my site and trying to gain access to users accounts so i beefed up security, however now users are complaining they keep getting logged out.

Here are the variables i use to validate the users and i dont want to strip them down any more can anyone give me any ideas for changing them so its still secure but not so strict as to keep logging the users out?

1. Username & password is encrypted into a cookie and verified on every page they visit.
2. There ip address is recorded on login and is checked against there current ip, on every page they visit via MySql.
3. When the user logs in a unix time stamp (mySql) is generated an updated of every page they visit and if it has not been updated in the last 60 mins the user is logged out.
4.I also generate a random key which is stored in the DB and is passed on every page via GET.
5.If a user tries to login and fails an email is sent to them and if 3 unsuccessful attempts user is locked out for 30mins.
 
 

Hello everyone,

I have a site where users sign up using an email address as their username.  I want to be able to verify that their email address is valid without having to send them a confirmation email that they have to click some link in before they are allowed to sign in to the website.  Maybe something that pings the email server for a specific address, and if the address is not valid, alert the user to enter a valid address.  Does anyone have any ideas or information that you could point me to to assist me with this task?  Thanks in advance for any help or ideas.

Ive put together a PHP/MySQLi login script for my site.

However I was wandering:
    1. Does Facebook use PHP Cookies or Sessions for their login? (Figured out my own answer )
    2. How does FB set the Cookie/Session so that when I log into facebook.com I am also logged into developers.facebook.com

Thanks in advance.

Hi,

I'm completely new to LDAP authentication but have managed to get a fairly smooth working script. However, I was wondering what is the easiest way to get a BASEDN from a Fully Qualified Domain Name.

At the moment I have a loop which would take:

example.com

and turn it into
dc=examplem,dc=com

But is that the best way?

Pardon my noobness, but I'm learning to wrap AJAX into my work and use it to get XML instead of "static" PHP that generates the HTML.  The login/security portion has my head spinning, but it's probably not as difficult as I think and I'm probably just confusing myself. 

In the past, for each PHP page in my site, I would perform a quick salted login check based on the username/password stored in the $_SESSION variables.  Perhaps it was a bit overboard to check on each page, but, well, I did it.

With AJAX, I *NEED* to ensure that the php resulting from an AJAX POST request won't run if the user isn't authenticated, and I need to ensure that they didn't just somehow force a $_SESSION variable to reflect an authenticated session.  I also need to ensure that someone can't just load up the PHP page on it's own, somehow send a POST to it and run it without being authenticated. 

I suppose that beyond the larger picture of "How do I ensure that the user is authenticated, the POST request is authentic, and nobody has forced a change in the $_SESSION stored on the server, I have a few specific questions. 

I know that in part I'm confused about the whole cookie/SESSION process.  In my old PHP site, the SESSION number was stored on the cookie on the user's machine.  If the info is sent via AJAX, does the PHP get the SESSION info from the cookie or does it have to be explicitly sent?  With potentially several users sending AJAX requests at the same time, how will my PHP know which SESSION to use for each request?

Is is secure enough to set an "Autheticated" flag in $_SESSION once the user is authenticated the first time?   Is it really just as simple as sending a username/salted password hash as AJAX/POST and setting an authenticated flag in the SESSION to ensure that the rest of the AJAX application runs without allowing someone to back-door the PHP?

The application that I want to build is quite simple. Here is a bit of the background of the work flow:

In my company, we create video for our client profile. After the video is done, we upload the video to our website and to youtube. It is done automatically.

After a period of time, the client can delete the video. Of course, it will delete the video in our system as well as the video in youtube. For now, the video in our system is deleted automatically. However, youtube video is deleted manually.

Our company has grown to have quite a lot of clients. It's hard for us to keep track clients that requested to delete their videos. We want to be able to have an application that will delete youtube video automatically.

I already tried to play around with youtube authentication in http://code.google.com/apis/youtube/2.0/developers_guide_php.html#Authentication but I have no luck with the authentication.

I want the application to be able to delete the video under my youtube account without having me to login to youtube. In my case right now, every time the application wants to delete the video, I have to send the request to youtube and ask for verification (i.e. I have to do application verification every time).

Here is what I have done so far:


ini_set('display_errors', 1);
ini_set('log_errors', 1);
ini_set('error_log', dirname(__FILE__) . '/error_log.txt');
error_reporting(E_ALL);


require_once('db_class.php');
require_once 'Zend/Loader.php';
Zend_Loader::loadClass('Zend_Gdata_YouTube');
Zend_Loader::loadClass('Zend_Gdata_AuthSub');
Zend_Loader::loadClass('Zend_Gdata_App_Exception');

session_start();
setLogging('on');
$_SESSION['developerKey'] = 'AI39si5H3hL9tcKOMl80IqzoC6nb87ka1QLgHxLp9nFi1l44dLa987_Gi0rbofLePQdFEWf1lrSB8KGs4lXIrcF8TR6PhUcO3Q';

function getAuthSubRequestUrl()
{
    $next = 'http://example.com/youtube_delete_video.php';
    $scope = 'http://gdata.youtube.com';
    $secure = false;
    $session = true;
    return Zend_Gdata_AuthSub::getAuthSubTokenUri($next, $scope, $secure, $session);
}

function updateAuthSubToken($singleUseToken)
{
    try {
        $sessionToken = Zend_Gdata_AuthSub::getAuthSubSessionToken($singleUseToken);
    } catch (Zend_Gdata_App_Exception $e) {
        print 'ERROR - Token upgrade for ' . $singleUseToken
            . ' failed : ' . $e->getMessage();
        return;
    }

    $_SESSION['sessionToken'] = $sessionToken;
        
    generateUrlInformation();
    
    header('Location: ' . $_SESSION['homeUrl']);
}

function getAuthSubHttpClient()
{
    try {
        $httpClient = Zend_Gdata_AuthSub::getHttpClient($_SESSION['sessionToken']);
    } catch (Zend_Gdata_App_Exception $e) {
        print 'ERROR - Could not obtain authenticated Http client object. '
            . $e->getMessage();
        return;
    }
    $httpClient->setHeaders('X-GData-Key', 'key='. $_SESSION['developerKey']);
    return $httpClient;
}

function generateUrlInformation()
{
    if (!isset($_SESSION['operationsUrl']) || !isset($_SESSION['homeUrl'])) {
        $_SESSION['operationsUrl'] = 'http://'. $_SERVER['HTTP_HOST']
                                   . $_SERVER['PHP_SELF'];
        $path = explode('/', $_SERVER['PHP_SELF']);
        $path[count($path)-1] = 'index.php';
        $_SESSION['homeUrl'] = 'http://'. $_SERVER['HTTP_HOST']
                             . implode('/', $path);
    }
}

function loggingEnabled()
{
    if ($_SESSION['logging'] == 'on') {
        return true;
    }
}

function setLogging($loggingOption, $maxLogItems = 10)
{
    switch ($loggingOption) {
        case 'on' :
            $_SESSION['logging'] = 'on';
            $_SESSION['log_currentCounter'] = 0;
            $_SESSION['log_maxLogEntries'] = $maxLogItems;
            break;

        case 'off':
            $_SESSION['logging'] = 'off';
            break;
    }
}

function logMessage($message, $messageType)
{
    if (!isset($_SESSION['log_maxLogEntries'])) {
        $_SESSION['log_maxLogEntries'] = 20;
    }

    if (!isset($_SESSION['log_currentCounter'])) {
        $_SESSION['log_currentCounter'] = 0;
    }

    $currentCounter = $_SESSION['log_currentCounter'];
    $currentCounter++;

    if ($currentCounter > $_SESSION['log_maxLogEntries']) {
        $_SESSION['log_currentCounter'] = 0;
    }

    $logLocation = 'log_entry_'. $currentCounter . '_' . $messageType;
    $_SESSION[$logLocation] = $message;
    $_SESSION['log_currentCounter'] = $currentCounter;
}

function printCacheWarning()
{
    return '<p class="note">'
         . 'Please note that the change may not be reflected in the API '
         . 'immediately due to caching.<br/>'
         . 'Please refer to the API documentation for more details.</p>';
}


function editVideoData($videoId)
{
    $httpClient = getAuthSubHttpClient();
    $youTubeService = new Zend_Gdata_YouTube($httpClient);
   $videoEntryToUpdate = $youTubeService->getFullVideoEntry($videoId);

    if (!$videoEntryToUpdate instanceof Zend_Gdata_YouTube_VideoEntry) {
        print 'ERROR - Could not find a video entry with id ' . $videoId
            . '<br />' . printCacheWarning();
        return;
    }

    try {
        $putUrl = $videoEntryToUpdate->getEditLink()->getHref();
    } catch (Zend_Gdata_App_Exception $e) {
        print 'ERROR - Could not obtain video entry\'s edit link: '
            . $e->getMessage() . '<br />';
        return;
    }

    $videoEntryToUpdate->setVideoTitle("My Test Movie - Private 10000012");
    $videoEntryToUpdate->setVideoDescription("My Test Movie - Private 10000012");
    $videoEntryToUpdate->setVideoPrivate();

    try {
        $updatedEntry = $youTubeService->updateEntry($videoEntryToUpdate, $putUrl);
        if (loggingEnabled()) {
            logMessage($httpClient->getLastRequest(), 'request');
            logMessage($httpClient->getLastResponse()->getBody(), 'response');
        }
    } catch (Zend_Gdata_App_HttpException $httpException) {
        print 'ERROR ' . $httpException->getMessage()
            . ' HTTP details<br /><textarea cols="100" rows="20">'
            . $httpException->getRawResponseBody()
            . '</textarea><br />'
            . '<a href="session_details.php">'
            . 'click here to view details of last request</a><br />';
        return;
    } catch (Zend_Gdata_App_Exception $e) {
        print 'ERROR - Could not post video meta-data: ' . $e->getMessage();
        return;
    }
        print 'Entry updated successfully.<br /><a href="#" onclick="'
            . 'ytVideoApp.presentFeed(\'search_owner\', 5, 0, \'none\'); '
            . 'ytVideoApp.refreshSearchResults();" >'
            . '(refresh your video listing)</a><br />'
            . printCacheWarning();
}


if (!isset($_GET['token'])) {

$returnURL = getAuthSubRequestUrl();
echo "<a href=".$returnURL.">Link To Google</a>";

} else {
$singleUseToken = $_GET['token'];
updateAuthSubToken($singleUseToken);

/* editVideoData('mJDRXXaFVGw'); */
}



This is how I call the function: http://example.com/youtube_delete_video.php

So, what I need basically is to know
1. how can I store the authentication after I verify it from youtube?
2. What function to populate after I store the authentication? <- I couldn't figure where this part is in the documentation.

PS: example.com is not a real url. It's just for the sake of writing the post he )

Hello all,

I am extremely new with php, I just started learning it this week. I am tryin to make a secure login page that uses cookies for authentication. The problem I am having is that I cannot seem to get it to detect or read the set cookie properly. I want it to detect if its the correct username in the cookie and if so, allow to see the page, and if now, then return to the login screen.

The login screen is login.html, which directs the person to the php script login.php. That should in turn show them a message page and some short info, as well as a link to their control panel (index.php) . The problem is that even if i skip the login I can still reach the control panel (index.php) with or without the cookie.

Here is my code (please be gentle this is my first week with php):

login.html:
Code: [Select]
<html>
<head>
<Title>Admin Login</Title>
</head>
<body>
<center>
<br>
<br>
<br>
<br>
<img src="pk.png">
<form action="login.php" method="post">
<br>
Username: <input type="text" name="username" /><br>
Password:  <input type="text" name="password" /><br>
<input type="submit" value="Login" />
</form>
</center>





</body>
</html>
login.php:
Code: [Select]
<?php

// Print a cookie
//echo $_COOKIE["auth"];

// A way to view all cookies
//print_r($_COOKIE);

//global $verified;

$verified=NULL;
global $cookie;
$cookie=$HTTP_COOKIE_VARS['auth'];

if($_COOKIE["auth"] = "Verified_Power" )
{
echo "You have been verified as PowerHouse. <br><br>";
$verified="TRUE";
}
else if($_COOKIE["auth"] = "Verified_Thor")
{
echo "it's actually thor!<br><br>";
$verified="FALSE";
}
else
{
echo "Bad Chookie";
$verified="FALSE";
exit();
}


?>
<html>
<head>

<Title>Login Info</Title>
</head>
<body>
<center>
<img src="pk.png">
<br>
<br>
<br>
Hello <?php echo($username); ?>!<br />


<?php //header("Cache-Control:no-cache");






$msgfile = "messages.txt";
$msgf = fopen( $msgfile, "r");
$msgsize = filesize( $msgfile );
if( $msgsize <= 0)
{
$msg=NULL;
}
else
{
$msg = fread( $msgf, $msgsize);
fclose($msgf);
}



If( $username == "PowerHouse" )
{
If( $password == "test")
{
//read logon file
$powerlogfile="Admin_Checkin/logs/powerlogon.txt";
$logfile = fopen( $powerlogfile, "r");
$logfilesize = filesize ( $powerlogfile );
$logcountpower = fread( $logfile, $logfilesize );
$logcountpower++;
fclose($logfile);
//open file for writing
$logfile = fopen($powerlogfile, "w");
fwrite( $logfile, $logcountpower);

fclose($logfile);
echo("You are logged in. <br><br>");
echo("It is you master! <br><br>");
if( $msg == NULL )
{
echo("No New Messages<br><br><br>");
}
else
{
echo("You have a message: <br>");
echo "$msg <br><br><br>";
}

echo "Click <a href='" . "/Admin_Checkin/14795" . "'>Here</a> To access your control panel.<br><br><br>";  
echo "You have logged in $logcountpower times.";

//open logfile to write to 
$logfile=fopen("Admin_Checkin/logs/powerlog.html", "a");
//write the time of access
$time=date("H:i:s: dS F");
fwrite($logfile, "<b>Time of access:</b> $time<br>");
//write users ip
if( $REMOTE_ADDR != NULL )
{
fwrite($logfile, "<b>IP Address:</b> $REMOTE_ADDR <br>");
}
//write users forwarding url
if( $HTTP_REFERER != NULL)
{
fwrite($logfile, "<b>Referer:</b> $HTTP_REFERER <br>");
}
//write users browser info
fwrite($logfile, "<b>Browser Info:</b> $HTTP_USER_AGENT <hr><br>");

setcookie("auth","Verified_Power", time()+3600);
//header("Location:login.php"); exit();

//setcookie('login', $_REQUEST['username'].','.md5($_REQUEST['username'].$secret_word));




}
else if( $password != "test" )
{
$pwfail++;
echo("<hr>You have entered the wrong password, PowerHouse. <br>");
}
}
else if($username == "ThorSummoner")
{
If( $password == "test")
{
//read logon file
$thorlogfile="Admin_Checkin/logs/thorlogon.txt";
$logfile = fopen( $thorlogfile, "r");
$logfilesize = filesize ( $thorlogfile );
$logcountthor = fread( $logfile, $logfilesize );
$logcountthor++;
fclose($logfile);
//open file for writing
$logfile = fopen($thorlogfile, "w");
fwrite( $logfile, $logcountthor);

fclose($logfile);
echo("You are logged in. <br><br>");
echo("This is the Admin Portal Welcome Screen. <br><br>");
if( $logcountthor == 1)
{
echo "This is your first visit, yay! <br><br>";
}
//echo "$msg <br> <br>";

if( $msg == NULL )
{
echo("No New Messages<br><br><br>");

}
else
{
echo("You have a message: <br>");
echo "$msg <br><br><br>";
}

echo "Click <a href='" . "/Admin_Checkin/atfg4gc" . "'>Here</a> To access your control panel.<br><br><br>";  
echo "You have logged in $logcountthor times.";

//open logfile to write to 
$logfile=fopen("Admin_Checkin/logs/thorlog.html", "a");
//write the time of access
$time=date("H:i:s: dS F");
fwrite($logfile, "<b>Time of access:</b> $time<br>");
//write users ip
if( $REMOTE_ADDR != NULL )
{
fwrite($logfile, "<b>IP Address:</b> $REMOTE_ADDR <br>");
}
//write users forwarding url
if( $HTTP_REFERER != NULL)
{
fwrite($logfile, "<b>Referer:</b> $HTTP_REFERER <br>");
}
//write users browser info
fwrite($logfile, "<b>Browser Info:</b> $HTTP_USER_AGENT <hr><br>");

setcookie("auth","Verified_Thor", time()+3600);

}
else if( $password != "test" )
{
$pwfail++;
echo("You have entered the wrong password, ThorSummoner. <br>");
}

}
else if($username !== "PowerHouse" && $username !=="ThorSummoner")
{
echo("Who are you?");
}




?>
</center>
</body>
</html>

index.php
Code: [Select]
<?php


global $verified;
echo ($verified);

If( $verified == "TRUE" )
{
echo "You are verified";
}
else if( $verified != "TRUE" )
{
echo "You should not be here";
}
else if( $verified = NULL )
{
echo "Nulled out";
}
$cookie=$HTTP_COOKIE_VARS['auth'];

If( $cookie != "Verified_Power")
{
echo "No Cookie, or not correct cookie";
}

// A way to view all cookies
//print_r($_COOKIE);


?>
<html>
<head>
<Title>Power's Control Panel
</Title>
</head>
<body>
This is my control panel <BR>

test<br>
</body>
</html>
Any help would be greatly appreciated! Remember I am new so I am sure my code is poorly written. Please be polite.