Php Cookie Authentication + htacess on old website upgrade

Question

I'm updating my dad's old website. 99% complete. He has an online learning course that was done using frames and 1500+ images/pages. I created a cookie based login script that uses mysql to track users and the validity of the cookie. On each "protected" page my script appears, the cookie is rewritten with a special "code" and the code is also writen to my mysql server. Again on page load the two codes check each other and if the cookie is invalid logs them out.

This works very very well. The problem is, because of the frame based nature of the course, i would have to place said script on all 1500+ pages, not just the 10 "root" pages that combine all frames into a single page. The meat of the content is protected with my script, but people could access parts (images, videos) of the course via urls.

I am using this in my htacess file:

Options -Indexes

RewriteEngine On RewriteBase / RewriteCond %{HTTP_COOKIE} !logincookiename= [NC] RewriteRule .* http://www.somesite [L]

To block people who have no cookie, but it doesn't check if the cookie is "real". How can I make this better? Maybe check for the existence of a php variable that would only be created on "full" page load...don't really know how to get htacess to read said variable tho. Thanx for any help.

Answer 1

There's not much you can do on the Apache side of things to deal with PHP's internals. As you said, you can check for the existence of a cookie and its contents, but Apache can't use that cookie to peek into PHP's session file.

If you don't want to add proper session/permissions handling code to each script manually, you can hack some in using the php "auto_prepend_file" functionality, which'll cause PHP to load a specified file BEFORE the contents of the actual script. You could put the validation checks in there and it would act as if you'd manually included the code in each file.

As for the images/videos, those you'll have to protect in some other manner. There's plenty of discussions on SO on how to securely serve up files via PHP.