Directory access solution - please recommend.

Question

In regards to the site
http://www.myhappypeople.com
I need a simple directory access solution (that hopefully
doesn't let people bookmark an accessed page and go back to it
without logging in again). All I want is for a client to click one
link, which prompts a login/password screen, and based on their
input directs them to a directory/page they are allowed to view.
The DW 8 manual doesn't seem to really tell me how to do
anything but rather sends me in circles on the elements I need
(databases, page with forms, etc).
I've looked into some free CGI scripts, that don't seem to be
easy to update/maintain.
Can anyone offer a suggestion. It's the last thing I need to
figure out to complete this site.

Answer 1

Well, there's two ways of doing this: server level and app
level.
You can setup users in IIS and Apache and this will cause the
server to automatically prompt for login. However, this requires
access to the user database on the server and usually admin access
to set file permissions.
The way I prefer to handle it (and I'm not a security expert,
btw) it with a session cookie and an authenication script. I make a
file that checks to see if the session cookie for auth is set. If
not, it sends the user to a login page. I then include this file at
the top of every page I want to protect.
The login is then just a form that posts to a page the
verifies the password and sets the cookie. Now, this technique
isn't foolproof. If you're not using HTTPS, then you are sending
the password in clear text and it could be grabbed by a hacker.
But, for light security, it works pretty well and is easy to
deploy.
<?php
#fire up the session and see if user is logged in.
session_start();
if(isset($_SESSION["LOGGED_IN"]) &&
$_SESSION["LOGGED_IN"] == "TRUE"){
# Do something if needed. I connect to databases here.
}else{
#Redirect non-logged in request
header("location: /admin/login.php");
}