Cookie Authentication In ASP/html???

[jarekn]

Hello KirbyDE,

I hope you can help me out,

So how would I go about checking to see if the user is logged in and if he's not how can I redirect him to the login page.

My main site is at www.domain.com (IIS running HTML and ASP) and vBulleting is at forum.domain.com (PHP).

Your help would be very much apreciated.

Originally Posted by KirbyDE

No ... at least I think this isn't correct.

Do you want to verify that the cookies are correct or do you want to set cookies?

If you want to set cookies then it should be smth. like this (in PHP):

PHP Code:

setcookie('bbuserid', $userid, time() + 60 * 60 * 24 * 365, '/', 'domain.com');
setcookie('bbpassword', md5($password . 'FOOBAR'), time() + 60 * 60 * 24 * 365, '/', 'domain.com'); 


Where $userid is the user id, $password is md5(md5('password') . $salt) and FOOBAR is your vB License Number.

[Andreas]

You would have to check if both cookies (bbuserid and bbpassword) exist and if they are valid.
To do so you must query the vB user table for the given userid and check if md5(concat(password, 'LicenseNo')) is the same as the value of cookie bbpassword.
If not perform a header-redirect to login.php.

Unfortunately I can't give you code-examples as I don't know anything about ASP.

[jarekn]

Hello,

I know I can check for cookies in ASP, but there is no way for me to check if the password cookie is = to the password in the db.

Is there anything else I can do? or can I just asume that the if both cookies (user and password) exist that the user is valid?

[Andreas]

Originally Posted by jarekn

Hello,

I know I can check for cookies in ASP, but there is no way for me to check if the password cookie is = to the password in the db.

Why not? I am not familiar with ASP but it should be possible to access a mySQL-Server with ASP through myODBC.

> Is there anything else I can do?
No. You must query the database.

[jarekn]

The password is encrypted, how can I go about checking it to see if it is valid... would the password in the DB be the same as in the cookie and if so I guess I could just see if the dbpswd=cookiepswd .

Has anyone else done anything within ASP?

[Andreas]

As I already posted earlier, cookie bbpassword ist md5(concat(password, 'LicenseNo')) where LicenseNo is your vB license number and password is the value form the database.