Questions tagged [authentication]
Authentication is commonly understood as the act of asserting a user's or entity's identity, although in the wider sense it can refer to asserting the truthfulness of any kind of claim. Authentication, like encryption, is a major component in implementing computer security.
204
questions
0
votes
1
answer
30
views
How to solve chain of redirects
I have WordPress site where we use alias www.example.com/login to have nice login URL so it redirects user to standard WordPress login URL which is wp-login.php.
For the authentication we use service ...
1
vote
1
answer
218
views
Using dynamic content in Wordpress by decoding and using a JWT passed on the URL, without logging in any user
I have a Wordpress and I don't want to create users for the next functionality:
I need a page that has this behaviour:
URL1 = https://my-site.example.com/some-page/ => Renders some public content
...
- 265
1
vote
0
answers
9
views
How can I avoid my web game's accounts system being spammed?
I've been developing a web game and so far the game can only be played anonymously. However, I'd like to introduce an accounts system to allow some kind of community to build up around the game. ...
- 111
0
votes
0
answers
13
views
Reduce traffic to authentication backend servers
I have been given the job of hosting a site. This site contains only static content, ie. HTML that has been generated by a container pipeline and is updated by the same pipeline.
I was told they ...
- 123
0
votes
0
answers
24
views
Shibboleth installation on webhosting
We are trying to use Shibboleth for authorization on our website using an education SP. We got the Shibboleth Authentication working on local servers but are now stuck on taking this online. We are ...
- 1
2
votes
3
answers
541
views
Why do I have to enter basic authentication credentials twice for WordPress with .htaccess?
I protect the wp-login.php file via my .htaccess file:
<Files wp-login.php>
AuthName "Admin-Bereich"
AuthType Basic
AuthUserFile /*path*/htdocs/.htpasswd
require valid-user
</Files&...
- 141
0
votes
0
answers
23
views
Wordpress login attempts with personalized data
I recently got some login attempts on a self-hosted Wordpress site that make me a little bit nervous: The login attempts are non-standard usernames like "admin" or "root". They ...
4
votes
2
answers
291
views
Password protect specific files on root of website
I have had a website running for a while and it has a small following. What I wish to do now is password protect some specific files that sit in the root directory. So I'd like the user not to see any ...
- 301
1
vote
1
answer
163
views
How to disable windows login (so that WAMP can auto start)
I have Wamp 3.2.6 installed on a Windows 10 machine. I use it to serve photos and other files, and some apps, to my local community. Its not mission critical, so I don't monitor the machine constantly....
- 91
2
votes
1
answer
625
views
Can Google index page that is login-required and redirects to Login page?
I have one link that is login-required http://example.com/secret If user access the page without authentication it will be redirected to http://example.com/login page.
My question is can Google bot ...
- 23
2
votes
1
answer
82
views
How to exclude bounces from users just clicking "Sign In App" to navigate to a subdomain in Google Analytics?
I've got www.example.com and app.example.com. I control both. On the "www" site, there's a "Sign In" hyperlink that sends people to the app's login page (a known URL on the app ...
- 121
12
votes
7
answers
3k
views
What is an API key?
When we login to a service via a user account, we are normally required to provide an email and password (and on some occasions a username as well).
But, when one website's API authenticates to ...
- 121
5
votes
2
answers
1k
views
How to allow Googlebot unlimited crawling but to have a limit on individual users?
My website consists of multiple pages, each page is for a company. I plan to allow users that are not signed in to view the company pages, but limit to 10 companies a month. I will use a cookie to ...
- 319
2
votes
1
answer
85
views
Content that should be protected is served without authentication intermittently
Our website hosting is with a shared hosting provider. The only configuration we can make is through .htaccess files, we can't touch the apache configuration files that are sourced when apache first ...
- 23
1
vote
1
answer
1k
views
Can't turn off two-factor authentication for my Heroku web hosting account, even by using the command line instructions
I got a new phone and didn't save the recovery code. One day, when I tried to log in to the Heroku platform using my email and password, Heroku redirected to the https://verify.salesforce.com/v1/...
- 333
2
votes
1
answer
473
views
Should I automatically delete accounts if they have not verified their email address?
I am launching a new site soon and in my previous experience I know many bots will create accounts, I'm trying to avoid this so before a user can sign in they need to verify their email address. If ...
- 25
1
vote
1
answer
297
views
Is DMARC relaxed alignment for SPF/DKIM bad?
After studying authentication mechanisms available to prevent e-mail spoofing, still I don't understand how to choose between the relaxed alignment and the strict alignment in DMARC for SPF and DKIM, ...
- 13
1
vote
1
answer
189
views
Order of operations for CloudFlare and WordFence
A friend's website is connected to CloudFlare, through the domain name at least, and has WordFence installed. It was my understanding that CloudFlare has security that would block attackers, but ...
0
votes
0
answers
12
views
How can you set up certificates for clients to use in to log into a webpage in comparison to a username and password? [duplicate]
I've relatively new here and in the website world. I recently saw that some webpages (eg. some banks) use certificates for logging in. An example of what I'm looking for is here - http://poczta....
0
votes
0
answers
25
views
Show contents of a basic authentication login-protected site on my site with a proxy
I administer website A that provides information for a number of users. Website B is an external website containing information that I would like to provide to the users of site A. Login credentials ...
- 1
0
votes
0
answers
15
views
Joomla admin log in denied
I moved my site from wordpress to Joomla. I created account and was working fine. I tried to log into admin few days later but now my credentials arent being accepted. tried retrieving username and ...
- 1
1
vote
0
answers
59
views
How to prepare my website to Google's oncoming change regarding embedded browser frameworks?
I recently received an email from Google saying that:
We are writing to let you know that Google will discontinue support for sign-ins to Google accounts from embedded browser frameworks, starting ...
3
votes
1
answer
158
views
How to prevent login from 3rd party sites and apps
Most website content is only accessible after logging in. 3rd party sites (and apps) provide alternative interfaces to the site by passing on the login credentials and scraping content. How do I make ...
- 31
0
votes
0
answers
73
views
Why can't I send emails with my domain name emails without deliverability issues?
I have separate my website and email hosting. I use yandex smail service for email hosting. Everytime I send and email to an address, I get no dkim authentication issue even though, I have configured ...
0
votes
1
answer
61
views
How to get a website with a custom password entry form in index.php to prohibit access to all other files and folders
I have a family history website, call it "my_family.com". The primary file, index.php, has some introductory remarks of explanation and an html form into which one puts the website's ...
Owen Walker
2
votes
0
answers
149
views
Safari prompts for BasicAuth credentials on every request in WordPress admin area, but works fine on the rest of the site
I have a WordPress website which is in development, and is hidden behind a BasicAuth password prompt. My root level .htaccess file:
AuthType Basic
AuthName "Login Details"
AuthUserFile /var/...
1
vote
0
answers
59
views
SEO URL Behind Login That May/May Not Require Payment Structure
I have the following parent URL:
example.com/courses/course_name/
Currently, that parent URL can be accessed without a login.
When a user is logged in, and they try to access a video child URL, 2 ...
- 21
0
votes
0
answers
874
views
SEO How To Handle Pages That Require Login & Payment?
If you have URLs on your site that require a login but a user who is not logged in tries to access those login required URLs, how do you handle it? 401, 403, 404, 301 to a login page?
If the page ...
- 21
1
vote
1
answer
5k
views
why I can't login to cPanel, shows error Maximum Users Exceeded?
When I try to login to cPanel,
it shows an error Maximum Users Exceeded. please see the error message below. I didn't do any changes to server. this appears very suddenly. how can I fix this? I ...
- 13
3
votes
1
answer
946
views
In Apache make subdirectory require basic authentication while parent directory is open to the public
I want to make the contents of the directory /srv/www/dssx (mostly) public. The sub-directory /srv/www/dssx/basic-auth of /srv/www/dssx I want to protect with basic authentication. However, I cannot ...
- 151
1
vote
0
answers
1k
views
How to disable Google Ads two-step authentication
I currently am using my Gmail for SMTP for my site. But I also signed up for Google Ads. To sign into Google Ads, I have to two-step authenticate. But because of this, it disables the SMTP for my ...
- 111
2
votes
1
answer
63
views
increasing number of malicious login attempts- what to do?
My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a ...
- 123
1
vote
1
answer
30
views
How to correctly SEO positioning of articles that require authorization
I have website with lot of articles, but that require sign-in to view it. The titles of articles are public.
When user is not logged in but wants to see and read it, then will be redirected to login ...
- 111
4
votes
1
answer
82
views
Does the presence of a flash banner on a site inherently create a vulnerability on the site?
Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page.
The page in ...
- 43
0
votes
1
answer
64
views
Unable to login to local DHIS2: Getting a null value in the SessionId
I have installed DHIS 2 version 2.33.0 on a local instance following steps mentioned here. I have also restored the sample database dump. I am able to create new users, but couldn’t log in using ...
- 11
1
vote
1
answer
64
views
How can we turn off some LinkedIn login permissions to our website?
Our website is allowing logins from LinkedIn, but we are asking too many permissions from users.
The permission we are asking are:
Use your name and photo
Use the primary email address associated ...
- 11
1
vote
1
answer
299
views
Does django-oauth-toolkit handle pkce with oath2?
I am trying to implement oauth2 to my django app. I tried to use django-oauth-toolkit. I think their documentation is outdated and could not find any mention of pkce.
Also, I could not find any ...
- 149
1
vote
0
answers
10
views
Storing session data between servers (and noob guidance) [closed]
First post here, I'm sure this information is somewhere on the web, but the problem is I'm such a noob I don't know what to search for.
So, my problem is that I want to design a sign up API. Let's ...
- 111
1
vote
2
answers
80
views
Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?
I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control.
To be ...
- 113
2
votes
1
answer
210
views
How can I ban mediawiki logins from IPs that persistently fail?
I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords.
What can I do to ban IPs if they exceed a threshold of failed login attempts?
(Okay, no-...
- 323
1
vote
0
answers
37
views
Do Google Analytics sessions get broken when tracking UserID and ClientID across subdomains that may not send that data?
I have a domain name with three subdomains.
One where a user is authenticated and two where they aren't.
I'm planning on implementing UserID tracking for Google Analytics in place of the standard ...
- 21
2
votes
0
answers
60
views
After implementing HTTPS, "require valid-user" in subdirectory no longer asks for password, just gives 401 Not Authorized
I'm not very knowledgeable about server scripting, however I've only just installed SSL certificate for the domain.
The main website (hosted by GoDaddy) is now working fine on SSL/TLS and I've ...
- 21
1
vote
1
answer
249
views
Do most websites not use HTTP authentication header but something else for authentication?
https://curl.haxx.se/docs/httpscripting.html says
It is worth noting that while this is how HTTP Authentication works, very many web sites will not use this concept
when they provide logins etc.
...
- 113
1
vote
0
answers
22
views
Allow our own systems to use an API and restrict it from the general internet without using authentication
I have an Apache server which is reverse proxy'd to some Java container. In Java container there is an API that we don't want internet to see but expect our own systems to use it without any ...
- 111
1
vote
0
answers
2k
views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
- 111
0
votes
1
answer
49
views
It is harder for users to log on to my website when using gmails "+company" email address feature. How can I help them?
If you have a website and lots of people create his accounts with this format:
[email protected]
[email protected]
[email protected]
This issue is causing me several ...
- 222
1
vote
1
answer
42
views
How do I log in into Apache web server on Ubuntu from Windows?
I've been given a username and password for an Apache server, that runs on Ubuntu, and belongs to my professor.
I do not know how to connect to the server from my machine(windows), and run scripts ...
- 113
1
vote
0
answers
512
views
Why does CPanel keep prompting me for credentials
When I login directly to CPanel, I login successfully and can see various parts of CPanel (text only, no images), but the system keeps prompting me to login again.
When I login via WHM, everything ...
- 469
2
votes
1
answer
91
views
Individual directory options for every VirtualHost in Apache2
I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server).
There is a DNS server in the ...
- 31
1
vote
0
answers
32
views
double authentication for https password protected password
I am hosting a customer's OpenCart store on my own domain hosting. I have add-on domain in my CPanel for customer's domain and created sub domain for it to ease access. Other than the double ...
