Clever Geek Handbook

HTTP authentication security

My client needs a simple CMS database faster than I can solve the problems and disadvantages associated with globals registration, sql injection and cookie filtering.

I installed phpMyEdit and secured the edit page with .htaccess. For security experts, does this provide at least a moderate level of security?

+2


source to share


3 answers


This is a moderate level of security, yes.

The attack you need to be aware of is a brute force attack where the bad guy tries to use different username and password combinations over and over again. To fix this, you can block the user after n (10 reasonable) failed login attempts.



There are many ways to customize htaccess files as valid users go, but depending on the source you are using, be extra careful that there are default users or guest types your htaccess might let in.

+1


source


It all comes down to the fact that no one here knows how secure passwords are or if you've hacked in some way. If you need confidence that HTTP authentication works, then yes, it does. There's also more to it than you can configure, so just calling it "htaccess security" is ambiguous. All in all, just make sure you don't leave any parts publicly available and that the passwords are not "123" or "qwerty" and you'll be fine (probably).



+1


source


I also recommend ip to protect your protected directories or files for admin. Also I can't be ok with automated programs, you just need more practice, you should know about most of the hacking tricks used, just read more and more about SQL injection and so on ... Good luck.

+1


source






More articles:


All Articles