SECURITY Flaws in this design for User authentication.

Posted by Shao on Stack Overflow See other posts from Stack Overflow or by Shao
Published on 2010-04-02T16:48:12Z Indexed on 2010/04/02 16:53 UTC
Read the original article Hit count: 427

Filed under:
|

SECURITY Flaws in this design for User authentication.

From: http://wiki.pylonshq.com/display/pylonscookbook/Simple+Homegrown+Authentication

Note: a. Project follows the MVC pattern. b. Only a user with a valid username and password is allowed submit something.

Design: a. Have a base controller from which all controllers are derived from. b. Before any of the actions in the derived controllers are called the system calls a before action in the base controller. c. In each controller user hardcodes the actions that need to be verified in an array. d. The before action first looks in the array that has the actions that are protected and sees if a user is logged in or not by peaking into the session. If a user is present then user is allowed to submit otherwise user is redirected to login page.

What do you think?

© Stack Overflow or respective owner

Related posts about pylons

Related posts about authentication