quisp: restricting access (passwords, cookies, etc.)

quick server pages
| Manual page for Restricting(access)

## Password-protection

Here's a method for setting up password-protection for certain pages.``

1) Build a page that uses a `<input type=password> field.```

2) Submit this to a target page that compares the entered value with the current password, and if they match, sets a cookie to the value of the password, like this:

       #if @inpw = @ADMINPW
           #+ Set-Cookie ABC_ADMIN ....
       #endif

The cookie can be made to expire at the end of the user's browser session by not specifiying `Set-Cookie`'s `Expires:` attribute.``

3) The current password can be defined in your config file:

        varvalue:  ADMINPW=flibby

4) Then for each page you wish to restrict access to, near the top, put something like this:

       #cookie ABC_ADMIN
       #if @inpw != @ABC_ADMIN
         <h2>Access denied.</h2>
         #exit
       #endif

## REMOTE_HOST or REMOTE_ADDR

You can get the user's REMOTE_HOST or REMOTE_ADDR and compare it against a known list to enforce restricted access.`` The user's REMOTE_HOST also serves well as a SHSQL identity (used for record locking and identification on transaction logs).``

       #set USER = $getenv( "REMOTE_HOST" )
       #if @USER in fred@abc.com,george@abc.com
         #+ Set-Cookie ....
       #endif
       #sql identity @USER

Markup created by unroff 1.0, `` `` April 12, 2004.