Securing website contents

alflow

My website consists of PHP, HTML, JPEG and SWF files.

Only authenticated users are allowed to access the content.

I would like to use referer IP for user authentication, reason being, the content is being accessed from other authorised websites.

I would also like to use a MySQL db to input lists of allowed IPs (and also to control their access to portions of the website).

How might I achieve this?

Thanks
Alfred Low

PS: I have done some research, and most of it points to using .htaccess, which negates my requirement to use a MySQL db to record user profiles.

etully

It's been said a million times, the referer variable is extremely insecure. I don't mean it's a little insecure.

Using .htaccess is the correct way to do this and it does not preclude you from using MySQL.

I think there is a way to tell .htaccess to read from MySQL... but even if there isn't, all you have to do is write a PHP script that maintains user profiles in MySQL and every time it handles an ADD or UPDATE to the database, it writes to a .htpasswd file.

As for how to do it, Google is your friend. Try any combination of the words secure .htaccess password

dalecosp

etully wrote:
It's been said a million times, the referer variable is extremely insecure. I don't mean it's a little insecure.

So, should we suggest

$_SERVER['REMOTE_ADDR'];

instead?

etully

dalecosp wrote:

So, should we suggest $_SERVER['REMOTE_ADDR']; instead?

Earlier, etully wrote:

Using .htaccess is the correct way to do this