Is this code safe enough to password protect a page ?

[M4DM4X]

Hi guys,

I'm using the code below to password protect a page (it just requires a pw, no login).
It's a mix of php and html.
Do you think it is secured enough?

I don't know how to implement a temporisation/delay to this code to avoid brute forcing, but I've added a popup to show up after a wrong entry to slow down any attack.

I know I could protect the page via htaccess but I'd like to have a fancy page to show up to visitors instead of an ugly popup asking for password.
Thanks for any idea how to improve this code if you think it's not safe.

PS: sorry for posting an image instead of text but BHW seems to trigger an error msg when posting code. I copied the text version here:
https://pastebin.com/ahSzgJSf

 

[wbalma]

Well, it's a basic authentication program, should be fine if you're not protecting something valuable or sensitive.

 

[rafark]

Nope. You’re just redirecting to a public page.

 

[darksoultrip]

Nope. You’re just redirecting to a public page.

Right, his grantaccess.html would need to be .php and it would have to ensure they're authenticated before showing the content.

 

[M4DM4X]

Thank you guys for your feedback.
With the popup showing up after each wrong attempt I though it would be enough to slow down any attack. The attacker (or their bot) would have to click on the 'ok' button everytime before retrying, which makes the attack very slow.
Maybe adding a timer would be more efficient but don't know how to do this.

Right, his grantaccess.html would need to be .php and it would have to ensure they're authenticated before showing the content.

Do you know of a code to do what you suggest please? The php code to put on the grantaccess.php page to verify the authentication. It seems the verification done on the index.php page is not enough.. thanks mate.

 

[Gogol]

Have a simple htaccess auth like the follwong:

https://stackoverflow.com/a/14067161/1437261

and you will be fine.

Like @rafark said, you are redirecting to a non protected html page. If an user ever finds out the url, he will always be able to login to the protected page no matter what password you set after that. Additionally, your code has a couple of vulnerabilities.

1) You are not checking if $_POST['pass'] is a string. The attacker could easily pass an array here like page.php?pass[]=something and it will throw an warning to the user (This is why I hate php... If you do not know what you are doing, it can bite you back). Depending on the implementation, this can leak your code; or even open access.
2) You are not comparing the hashes properly. It should be a === and not a ==. For an example, try the following code..

var_dump(md5('240610708') == md5('QNKCDZO'));

It will return true, although they are different hashes. You should always use === to compare.

Also, it is never a good idea to hardcode passwords an usernames inside the source code.


However though... the exact code that you have right now should serve the purpose, if you turn error reporting off. For the point number 1, it will just throw a 500 error and stop right there.


Edit: If you hate htaccess password popups, then implement everything in php. Do not use html atall, and check if the user is logged in, in every page.

 

[Machairodont]

@M4DM4X

do it the right way, use a One Time Password, for example:

https://github.com/archiecobbs/mod-authn-otp
or if you don't have access to the apache:
https://github.com/Spomky-Labs/otphp
App to use to store and create One Time Password: FreeOTP

 

[M4DM4X]

@Gogol and @Machairodont you are such valuable guys thanks for all your recommandations I will check what you suggest and make the modifications accordingly. Hope it will up my php game for future projects.

Yep htaccess is the safest and simpliest way to protect a page but it also asks for a username and in my case I don't want that. I only want to share the protected page with a few people without any login. Also I want a fancy page, not an old ugly popup, unfortunately htaccess popups can't be customized.

I put a noindex tag on the protected page so it is not indexed. Plus I changed its name to something complicated so it cant be guessed.

First thing I will do is replace the == by ===, thanks Gogol for the heads-up. And then check the rest. Thanks again guys.

 

[rafark]

With the popup showing up after each wrong attempt I though it would be enough to slow down any attack. The attacker (or their bot) would have to click on the 'ok' button everytime before retrying, which makes the attack very slow.

Brute force attacks can and usually happen from the console (command line), so no pop ups or JavaScript are involved), just pure http requests.

 

[Gogol]

Brute force attacks can and usually happen from the console (command line), so no pop ups or JavaScript are involved), just pure http requests.

Agreed, and it is damn easy to do with something like hydra (i think.. I’d use node/python though).

 

[M4DM4X]

Brute force attacks can and usually happen from the console (command line), so no pop ups or JavaScript are involved), just pure http requests.

I wasn't aware of this! It puts my strategy into trouble.
I am going to tweek the whole code then, maybe add a delay between each attempt or limit the number of attempts per ip if I find a script for this.

 

[shuttershades]

Why you are not using a Recaptcha?

 

[darksoultrip]

Thank you guys for your feedback.
With the popup showing up after each wrong attempt I though it would be enough to slow down any attack. The attacker (or their bot) would have to click on the 'ok' button everytime before retrying, which makes the attack very slow.
Maybe adding a timer would be more efficient but don't know how to do this.


Do you know of a code to do what you suggest please? The php code to put on the grantaccess.php page to verify the authentication. It seems the verification done on the index.php page is not enough.. thanks mate.

I would set a session variable after successful login and check for that the session variable on the grantaccess.php page along with any other pages where a user must be authenticated to be view the content. Check the session variables first as you have to do this anyway.

To be a coding entrepreneur you must be a hacker and a coder.

This looks good to me for your purposes.

if (empty($_SESSION['user_id'])) {
die("access denied");
}

To check if user is authenticated.

I grabbed it from Stack Overflow.

https://stackoverflow.com/a/5632274
Set that session variable after they're verified and check for it on grantaccess.php

---

Although this is still a little rudimentary. I could fake the user_id using Burp Suite.

How bad do people want to hack it to get access to what's on the other side. That's what should determine how far you go with it.

You might want to check for additional things like set a unique session ID although that starts to get more complex. Stack Overlfow is your friend.

 

[M4DM4X]

I would set a session variable after successful login and check for that the session variable on the grantaccess.php page along with any other pages where a user must be authenticated to be view the content. Check the session variables first as you have to do this anyway.

To be a coding entrepreneur you must be a hacker and a coder.

This looks good to me for your purposes.



To check if user is authenticated.

I grabbed it from Stack Overflow.

https://stackoverflow.com/a/5632274
Set that session variable after they're verified and check for it on grantaccess.php

---

Although this is still a little rudimentary. I could fake the user_id using Burp Suite.

How bad do people want to hack it to get access to what's on the other side. That's what should determine how far you go with it.

You might want to check for additional things like set a unique session ID although that starts to get more complex. Stack Overlfow is your friend.

Stackoverflow is my best friend these last days that's incredible all we can do thanks to the people who share on this site, even if our coding knowledge is not so good.

Thanks for the session suggestion, I thought of this too but it seemed very complicated to me so I ditched this solution. Might consider it again, session/token is a good way to increase security.

The page I'm protecting won't interest hackers enough to get the password, it's just a personal website with some private stuff I am sharing with people I like.

I think I will hire a coder to get me a proper script.

Why you are not using a Recaptcha?

Could be a cool solution indeed, didn't think of it.
Let's put a captcha while I'm improving the code, thank you much for the suggestion buddy.

 

[trane8881]

Hi guys,

I'm using the code below to password protect a page (it just requires a pw, no login).
It's a mix of php and html.
Do you think it is secured enough?

I don't know how to implement a temporisation/delay to this code to avoid brute forcing, but I've added a popup to show up after a wrong entry to slow down any attack.

I know I could protect the page via htaccess but I'd like to have a fancy page to show up to visitors instead of an ugly popup asking for password.
Thanks for any idea how to improve this code if you think it's not safe.

View attachment 180717

PS: sorry for posting an image instead of text but BHW seems to trigger an error msg when posting code. I copied the text version here:
https://pastebin.com/ahSzgJSf

As said before
grantaccess.html => to grantaccess.php

create a session in login page (i assume it's index,php)

some simple example:

session_start();
$_SESSION["name"]=$variable;

then when you try to login verify session in grantaccess.php page, if success show content, else redirect to accessdenied.php page with error message else index.php

if(!isset($_SESSION["name"])){
header("Location: accessdenied.php");
exit(); }