CODEWITHSUNDEEP
apache
BigRob
BigRob

Reputation: 160

Need advice on a secure webserver for clients to log into and view data

Hey guys, i've been googling ambitiously but my searches seem to be somewhat ambiguous so I thought i'd ask here.

My company has asked me to look into a web portal system that allows clients to log in via their browser and view/download their specific invoices / reports (the web server would be inhouse).

These (initially at least) would be static documents, pdf's, maybe excel spreadsheets and the like.

What I want to happen is a customer heads to our website (hosted elsewhere), clicks a link that takes them to a secure login for our webserver, they then enter their login details and are taken to their respective 'folder' on our webserver. Here they can download pdf's - that we keep up to date.

The main considerations are for it to be secure such that users can't access other users' folders and for users not to have to install anything to be view download their documents.

I'm setting up a pc to be a LAMP server right now, i've read WebDAV would be a good way to go but i'm not sure about how to get that working in a browser? Any advice or resources you guys can point me to give me a bit more direction would be greatly appreciated.

Thanks, Rob

Upvotes: 1

Views: 47

Answers (1)

sarnold
sarnold

Reputation: 104080

If you've only got a handful of accounts to manage, apache's built-in HTTP Auth password stuff works pretty well; you write usernames and hashed passwords into an .htpasswd file with the htpasswd utility.

Then you use <Location> directives to specify the URL and directories to find the data, and inside the <Location> directives, use the Require directive to either list specific usernames or valid-user.

Just make sure your .htpasswd file isn't stored in the web root. You don't want people to get a hold of the thing and start brute-forcing your passwords (or see your other allowed users, in case client privacy is a priority).

But it is pretty heavy maintenance -- password changes pretty much have to go through a human. I imagine someone has scripts to automate that, but I wouldn't trust them very far. :)

If you want something that scales larger, I think you might be better off building such a tool yourself.

Upvotes: 1

Related Questions