vqServer: Security extras


vqServer provides a built-in alternative to the HTTP basic authentication scheme which provides a number of extra features that would otherwise require complex additional programs:

  • Self-registration: You can allow visitors to your web site to add themselves to your vqServer user database. This means that you can easily require people to register for access to pages or files on your web site.
  • Custom login pages: You can provide custom login pages to restrict access to pages or files on you web site.. Custom login pages can be far more user-friendly than the default password dialog displayed by web browsers.
  • Self-password change: You can allow users to change their passwords without the intervention of the administrator and without having access to the control centre.
  • Logout: You can provide a logout link on your web pages. This stops people circumventing vqServer's access controls by using the same computer and browser as a registered user.

Notes:

  • To understand how to use these features, you should read the aliases and security pages of this documentation.
  • These features require that the computer name being used to access your website, the Computer name in the System settings form and the computer name used in remote registration pages and logout links are the same. If you are experimenting offline, try changing all of these to localhost.
  • These features use cookies. Your registration pages should probably include a warning about this.
vqServer
Register (free!)
Support

Contents

Security
MIME types

Self-registration

You can allow visitors to your web site to add themselves to your vqServer user database. This means that you can easily require people to register for access to pages or files on your web site.

There are five components to the vqServer self-registration feature:

  • A file or directory to which access is restricted. Its access control list must have Allow self-registration enabled. The sample web site distributed with vqServer contains the directory website/registered whose alias is registered. Access to this directory is restricted to members of the Self-registered users access control list.
  • A page to be displayed after successful registration. You'll usually want this to include an index to the files and services for which registration is required. An example page, website/registered/index.html, is included in the sample web site distributed with vqServer.
  • The remote registration servlet, vq.server.userreg. This is included in vqServer's classes.zip file and is called using the alias userreg in vqServer's default configuration. This servlet is called by the registration form.
  • A registration form. A sample form is included on the page website/public/register.html provided with vqServer. You may want to include this form on the same page as a custom login form for persons who are already registered. Access to the page containing the registration form should not be restricted.
  • A link pointing to a page which contains a registration form. The sample home page provided with vqServer includes a link labelled User registration.

Notes:

  • The self-registration feature works best if a custom login page is specified for the access control list used. If not, users will have to enter their ID and password in their browsers' password dialog box soon after registering.

The user registration form:

  • must use the POST method.
  • must specify an alias which maps to the vq.server.userreg servlet in its ACTION tag.
  • must contain the following fields:
    • acl: the ID of the access control list that persons who register will be added to. The ID of access control lists is displayed in the left-hand column on the access control lists page and is usually something like acl123. This should be a hidden field.
    • entrypage: the URL of the page which will be displayed following successful registration. This should be something like http://mycomputer/registered/index.html. This should be a hidden field.
    • id: the ID the person will use in the future to identify themselves to vqServer. This should be an edit field.
    • pwd1: the password the person will use in the future to identify themselves to vqServer. This should be a password field.
    • pwd2: the same as pwd1.
  • may contain the following optional fields which are added to the user's entry in vqServer' user database after successful registration. These optional fields may be used to collect information about the user at the time of registration.
    • name
    • email
    • address
    • notes
vqServer
Contents
Extras

Security
MIME types

Custom login pages

You can provide custom login pages to restrict access to pages or files on your web site. A custom login page is displayed automatically when a visitor to your web site requests a protected page. If a visitor enters an acceptable ID and password the protected page is displayed automatically.

Custom login pages can be far more user-friendly than the default password dialog displayed by web browsers and can include a self-registration form.

There are four components to the vqServer custom login page feature:

  • A file or directory to which access is restricted. The sample web site distributed with vqServer contains the directory website/private whose alias is private. Access to this directory is restricted to members of the Private user group access control list.
  • The login servlet, vq.server.userlogin. This is included in vqServer's classes.zip file and is called using the alias userlogin in vqServer's default configuration. It is called by the login page.
  • A login form. A sample form is included on the page website/public/login.html in the web site provided with vqServer. The location of this page must be specified in the Settings form of the access control list which restricts access to the protected file or directory.
  • A link to the protected file. The sample home page distributed with vqServer includes a link labelled Private files.

Login forms:

  • must use the POST method.
  • must specify an alias which maps to the vq.server.userlogin servlet in its ACTION tag.
  • must contain the following fields:
    • id: the user's ID. This should be an edit field.
    • pwd: the user's password. This should be a password field.
vqServer
Contents
Extras

Security
MIME types

Self-password change

You can allow users to change their passwords without the intervention of the administrator and without having access to the control centre.

There are three components to the vqServer self-password change feature:

  • The password change servlet, vq.server.userpwd. This is included in vqServer's classes.zip file and is called using the alias userpwd in vqServer's default configuration. Access to this servlet must be restricted by an appropriate access control list; otherwise it will not work.
  • A password change form. A sample form is included on the page website/registered/password.html included in the web site provided with vqServer. This form calls the password change servlet.
  • A link (or links) to a self-password change page. These links should only be included on pages to which access is restricted. The page website/registered/index.html contains a link labelled Change password.

The password change form:

  • must use the POST method.
  • must specify an alias which maps to the vq.server.userpwd servlet in its ACTION tag.
  • must contain the following fields:
    • pwd1: the password the person will use in the future to identify themselves to vqServer. This should be a password field.
    • pwd2: the same as pwd1.
vqServer
Contents
Extras

Security
MIME types

Logout

You can provide a logout link on your web pages. This stops people circumventing vqServer's access controls by using the same computer and browser as a registered user.

There are two components to vqServer's logout feature:

  • An exit page which will be displayed once the user is logged out. The sample web site included with vqServer includes the page website/public/thankyou.html.
  • The logout servlet, vq.server.userlogout. This is included in vqServer's classes.zip file and is called using the alias userlogout in vqServer's default configuration.
  • A link (or links) which invokes the logout feature. These links should only be included on pages to which access is restricted. The page website/registered/index.html in the sample web site provided with vqServer includes a link labelled Logout. The HTML code for this link should look like
    <A HREF = "/userlogout?exitpage=http://mycomputer/exitpage.html" > Logout </A>

    where userlogout is the alias which invokes the logout servlet, mycomputer is the name of your computer and exitpage.html is the exit page which will be displayed after the user logs out.


vqServer version 1.03. Copyright © 1997-98 vqSoft and Steve Shering. Last updated 13 May 1998.

vqServer
Contents
Extras

Security
MIME types