quick server pages
   
Manual page for Restricting(access)

Password-protection

Here's a method for setting up password-protection for certain pages.

1) Build a page that uses a <input type=password> field.

2) Submit this to a target page that compares the entered value with the current password, and if they match, sets a cookie to the value of the password, like this:

   #if @inpw = @ADMINPW
       #+ Set-Cookie ABC_ADMIN ....
   #endif
The cookie can be made to expire at the end of the user's browser session by not specifiying Set-Cookie's Expires: attribute.

3) The current password can be defined in your config file:

    varvalue:  ADMINPW=flibby

4) Then for each page you wish to restrict access to, near the top, put something like this:

   #cookie ABC_ADMIN
   #if @inpw != @ABC_ADMIN
     <h2>Access denied.</h2>
     #exit
   #endif



REMOTE_HOST or REMOTE_ADDR

You can get the user's REMOTE_HOST or REMOTE_ADDR and compare it against a known list to enforce restricted access. The user's REMOTE_HOST also serves well as a SHSQL identity (used for record locking and identification on transaction logs).
   #set USER = $getenv( "REMOTE_HOST" )
   #if @USER in fred@abc.com,george@abc.com
     #+ Set-Cookie .... 
   #endif
   #sql identity @USER




Markup created by unroff 1.0,    April 12, 2004.