لطفا منتظر باشید ...
Types of Authentication
Chances are you have needed to log in to a website in the past, so you should be aware of how the process of authentication works from a user's point of view. Generally speaking, you are asked to enter a usernamesometimes your email addressand a password.There are actually two ways that a website can authenticate a user, though: using basic HTTP authentication and using session-based authentication. The following sections clarify the differences between these two methods.
Basic HTTP Authentication
Basic HTTP authentication can be performed by web server, without having anything to do with PHP script. The example in this section assumes that you are using Apache web server; for other web servers, you should refer to your documentation.Authentication is usually done on a per-directory basis but can be set up to apply to individual files if required. By using an .htaccess file on your website, you can specify for that directory a custom configuration that instructs the web server to require a login before proceeding. A typical set of configuration directives would look like this:
AuthUserFile points to the location of a password file that is created by using the htpasswd program. To create a new password file, you would run a command like the following:
AuthType Basic
AuthName "Protected Website"
AuthUserFile /home/yourname/htpasswd
require valid-user
$ htpasswd c /home/yourname/htpasswd chris
New password:
Re-type new password:
 | Password Files You should use the c switch only when you want to create a new file. The htpasswd program does not ask whether you want to overwrite an existing file. Running htpasswd without the c option on an existing password file adds a user. |
When you try to access a file in the protected directory, your web browser pops up a window that asks for a username and password, and the page requested loads only after you have entered the correct information.The require valid-user directive instructs the web server to show the page to any authenticated user. You might want to grant access to only certain users, which you can do with the require user directive:
chris:XNiv7qSUTFPU6
damon:ZxxE2PTEXeVNU
shelley:SVzAEtxMLEAls
vanessa:cX/t1Pv2oQfrY
Basic HTTP authentication also allows you to set up user groups to give access to particular sections of the site only to certain users. You can then use the require group directive to specify access to one or more user groups.The following groups file, usually named htgroups, divides the users in the password file into two groups:
require user chris damon shelley
To give access only to the boys group, you could use the following .htaccess file:
boys: chris damon
girls: shelley vanessa
Although it is fairly easy to set up and reasonably flexible, basic HTTP authentication has some drawbacks. First, you cannot change the look and feel of the pop-up login box. If you want to customize the process at all, you cannot use this method. Furthermore, the password file is stored on the server's filesystem, and updating it from a script may be problematic; you will learn more about these issues when dealing with reading and writing to files in Lesson 17, "Filesystem Access."
AuthType Basic
AuthName "Boys Only"
AuthUserFile /home/yourname/htpasswd
AuthGroupFile /home/yourname/htgroup
require group boys
Session-Based Authentication
To provide a completely customizable login process for your website, you must implement it yourself, and doing so in PHP requires using session variables.In a nutshell, once a user is logged in, the browser's session contains enough information to convince the scripts on the website that you are allowed to view a page. Users log in by using a form on your site where they enter their username and password. You can set up the layout and flow of the login process any way you see fit.One fairly significant difference from basic HTTP authentication is that the instruction to check the validity of a user's session appears in the script itself, not in a per-directory configuration file.
