Re: Apache authentication efficiency

How I do it...

1. Set up user in a validation list (*VLDL) with user and password. This
is usually validated through email and their account isn't active until the
click a link with a token (and IP, etc) in it to check against.
2. When they log on, validate against the validation list.
3. If it's good, generate a unique session ID/token and an expiration.
Store it in a file (with IP, and other info) in a file to match it to the
ID. Put the token in a cookie.
4. Each request is validated against the token from the cookie (and IP
address, etc).

Don't forget to set up a "forgot my password" link. Validation lists you
can't retrieve the password, you can only validate against it to see if the
one entered is correct.

If you wanted to use OSS (node, etc) I bet there are built in token/oauth
features you could use.

You've signed up for things before online, no doubt (like this list, FB,
Linked in, etc) , so you should be pretty familiar with the high level
process.

Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #15 <https://www.bvstools.com/mailtool.html>: The ability
to add a Footer to each email sent using an IFS stream file.

On Fri, Jan 31, 2020 at 8:44 AM Justin Taylor <JUSTIN@xxxxxxxxxxxxx> wrote:

"Roll your own" was what I was expecting. Can you point me to a link to
start my research, or a good set of Google search criteria?

Thanks



-----Original Message-----
From: B Stone [mailto:bvstone@xxxxxxxxx]
Sent: Thursday, January 30, 2020 5:01 PM
To: Web Enabling the IBM i (AS/400 and iSeries) <web400@xxxxxxxxxxxxxxxxxx

Subject: Re: [WEB400] Apache authentication efficiency

Would you be against rolling your own using cookies/tokens? It's how I've
done it on quite a few projects. And it's how a lot of larger sites do
things.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.