|
Site Security
Controlled Access
Some other types of controlled access needn't be so sophisticated to accomplish similar goals. You can simply hide a group of files in a hidden or secret directory on your site
who's name you change frequently to keep out unauthorized persons, requiring no special technology. For instance you can create an entire directory of webpages in the fashion
www.bobsite.com/secret7/page1.html and of only few people are given the URL with secret7 in it, no one can guess it. This can be cheated on, though, if you neglect to put 'root'
files in all of your directories!
A root file is usually one that the server delivers by default if someone requests an incomplete or unfinished URL. For example, www.bobsite.com/ and www.bobsite.com are incomplete
because they lack a filename or directory symbol (/) on the end. When such a URL is encountered the server will either deliver a listing of the entire contents of the site in a file
and directory list, commonly called an Index Of listing, or deliver the user the default file, usually /index.html or /home.html. If you create a directory without a file named
as one of those default filenames, which can happen in lower directories, a visitor may view all the files and other directories beneath that "unprotected" directory! If this danger is
observed, and directory names are changed regularly this is the simplest method of access control for small transaction type subscription content, as you can send a customer to an
external billing and access control website, and have them referred back to the correct, current location of your content with a minimum of fuss.
These two methods can even both be used for different areas, or levels of site security, but the CGI system is the most secure, not that it requires any less attention than simpler methods.
Needless to say, if your site will be a collaborative database, with multiple contributors or even something as simple as a message board that accepts data from it's users, a greater
attention to both monitoring and security considerations is required. For any truly large, shared database type collections, a true database management system is required, and then
the site itself would require sophisticated policies and multiple levels of security to make it work. This is normally beyond the scope of any regular sort of public or plain commercial website.
The most common method used otherwise is the server's htaccess method, available on most UNIX servers. You need to be able to use telnet (type telnet www.yourdomain.com into W95's [Run] bar) to set this up, in conjunction with your ftp:// program. The term for this type of privilege is called a "shell" account with your ISP, who will give you a username and password for these purposes. It's a fairly simple process to set up and use, to protect content fully from unauthorized access. IE 5 has a new bug in this regard!
|