Re: ASP authentication

["Saphyr" <saphyr () infomaniak ch>]

> > I usually don't implement anything crazy for authentication to
> > specific pages. At the top of each ASP page I have a function call
> > require(rolename), which checks the session variables to see if the
> > role is included. If not, redirect to the login. The login sets up the
> > roles. End of story.
>
> Yeah.  I agree.  For *authentication*, that is pretty much it.  Behind
> the scenes, encrypted sessions are a good thing solely as an added layer
> of protection against database server breaches...nothing more.  

We hereby have a practical example of the difference between what would
be theoretically perfect (ssl encryption, strong validation, impersonation, 
hijack detection, session replay attacks and so on...) and what was practicaly
implemented: checking if a session value tells wether you're in a role or not.

Like Ido said, it's good to think "what we should do best ?" but even far better
to think "who are we protecting against ?", thus often avoiding useless (and 
more expensive) work ; ) 

.antoine