SECURITY Flaws in this design for User authentication.
Posted
by Shao
on Stack Overflow
See other posts from Stack Overflow
or by Shao
Published on 2010-04-02T16:48:12Z
Indexed on
2010/04/02
16:53 UTC
Read the original article
Hit count: 422
pylons
|authentication
SECURITY Flaws in this design for User authentication.
From: http://wiki.pylonshq.com/display/pylonscookbook/Simple+Homegrown+Authentication
Note: a. Project follows the MVC pattern. b. Only a user with a valid username and password is allowed submit something.
Design: a. Have a base controller from which all controllers are derived from. b. Before any of the actions in the derived controllers are called the system calls a before action in the base controller. c. In each controller user hardcodes the actions that need to be verified in an array. d. The before action first looks in the array that has the actions that are protected and sees if a user is logged in or not by peaking into the session. If a user is present then user is allowed to submit otherwise user is redirected to login page.
What do you think?
© Stack Overflow or respective owner