Apache folder protection methods vs cookie & database query for protecting website content and managing access rights. Which is best?

Question

I am looking at user/subscription management software such as aMember Pro. This uses folder protection methods to prevent access to areas of the site. As such the PHP scripts require Apache (linux/unix).

My webserver is IIS windows 2003 and I use a MySQL database to store user id and subscription status / access privileges. We really only have 2 types, free / paid. When a user logs in I store their user id in a session cookie and use this to check subscription status on each page and determine what they can view on this page (there are only a few pages and they are all in the same folder on the webserver).

What are the pros/cons of each method? Is my cookie & database method suitable and secure enough? I don't want to have to switch to linux if I don't need to and all other aspects of the aMember software work ok on windows.

Is folder protection only really required if a site is not using a database to store user id. We had the access rights thing all done prior to bolting on the subscription management software so my hunch is that we don't need to use folder protection, but I am keen to get others opinions.

thanks

Answer 1

You don't have to switch to Linux; Apache will run fine on Windows. If you want to stick with IIS, you could enable PHP with FastCGI.

Answer 2

Well the authentication you are talking about looks like a basic HTTP authentication in Apache which needs the user to authenticate on every request. From the apache doc

The client browser caches the username and password that you supplied, and stores it along with the authentication realm, so that if other resources are requested from the same realm, the same username and password can be returned to authenticate that request without requiring the user to type them in again.

So your session based approach is a little different than the folder protection because it is a long term session living longer than one request and it is managed by PHP not the webserver.

The server side session approach is quite common in almost any page that needs user authentication and proved secure enough to work with (even if it has its vulnerabilities). In any case, if you are concerned about security you have to make sure that the authentication (which normally transfers a plain password) runs over a secure (SSL) connection.