Tag Info

New answers tagged

1

I'd do it this way: A user can hold a number of Roles within your application (including none). These will be retrieved from an external data store. Any control within your application is available to any number of Roles. These might be statically defined or loaded from an external data store. A Control becomes "available" when the current User's ...


5

You can't, because the user is already convinced that he/she is using the right credentials. The best that you can do is to reset their account and inform them of their new password along with instructions on how to proceed. If you have access to their 'old' password (which is a security risk of itself), then you could just send out a reply telling the ...


-2

We use following code: session_start(); if(isset($_SESSION['logged_in'])) { $uid=$_SESSION['userid']; } else { header("location:".BASE_HREF."login.php"); } include '../styles/templates/admincp/header.php'; include '../styles/templates/admincp/content.php'; We use above code. Please analyse it carefully. How it works: 1) At start we have to verify the ...


1

As other answers have made clear, the problem as stated does not have a perfect solution, only approximations and disincentives. If you need to establish before creating an account that the user has not already opened one, then there is nothing more to add. Non immediate approach However, if it is acceptable to create an account without checking identity, ...


3

Unique user identification is the problem, and basically you're limited in what you can do about it. Many systems have begun to depend on tools like OpenID (which in turn depends on "identity providers"). However, this is an inadequate solution in some cases, because little prevents a user from establishing multiple OpenID identities. Normally, the way we ...


-2

You could take a look at the Indian Aadhaar program: http://en.wikipedia.org/wiki/Aadhaar Whcih tries to provide each Indian (now +future) with a unique ID, which can also serve for banking etc.... To add a little rant: The question asked by the OP is not a technical one per se. Sure, you could discuss endlessly about identification schemmas etc. but the ...


1

It comes down to an if statement finally somewhere in your code. Personally I've something more similar to this: if ( true === (bool) $_SESSION['user']['login'] && 0 < (int) $_SESSION['user']['id'] && time() <= ((int) $_SESSION['user']['last-activity'] + 20 * 60) && $_SERVER['REMOTE_ADDR'] === (string) ...


0

At some point, all authentication comes down to an if statement. If this user is logged in... If this user has manager privileges... If this user has admin privileges... If this user has connected from an OAuth provider... There are many methods for including (or excluding) the privileged features: Hide the things the user isn't allowed to see Don't ...


1

Here is a different way of looking at the problem. You have a site membership list and a new applicant. How do you know if this applicant already has an account on your website? The short answer is that you can never be certain... ...but there are things that can be tested. Can you validate any of the personal information they provided? A common one is ...


8

The problem is called "identification". The token uniquely identifies a person and you want to prevent people from obtaining multiple identities. The best solution we have for that are government passports and ID cards, or rather the methods used to distribute them, which mostly rely on cross-checking public records, especially birth records. But it's ...


10

The task as stated is impossible. You might be able to come acceptably close depending upon your ability to compel evidence (ssn, drivers license, birthdate, etc). But unless you're a govermental site, most people will just go elsewhere.



Top 50 recent answers are included