web programming question

[ronthemon]

First off let me go ahead and say thank you to anyone that can help me
out here.

I am an industrial designer trying to set up a website that would allow
my clients to login securely and access files for downloading. I am
comfortable with HTML and JavaScript, but want something secure, I have
messed about with some ASP scripts, but have not really got what I
want, basically I would like to be able to setup multiple usernames and
passwords that when entered would display a directory tree in the
browser window and allow files to be downloaded.

Thanks to anyone that can help.

 

[Adrienne Boswell]

Gazing into my crystal ball I observed (e-mail address removed) writing in

First off let me go ahead and say thank you to anyone that can help me
out here.

I am an industrial designer trying to set up a website that would allow
my clients to login securely and access files for downloading. I am
comfortable with HTML and JavaScript, but want something secure, I have
messed about with some ASP scripts, but have not really got what I
want, basically I would like to be able to setup multiple usernames and
passwords that when entered would display a directory tree in the
browser window and allow files to be downloaded.

Thanks to anyone that can help.

You're going to have to do it server side - client side is just too
risky, both for you and the client.

My suggestion is to set up a simple database with username, password and
any other information would like to collect. Have the users login and
use a server side script to redirect them to the download page.

With that said, it's also a good idea to look into SQL injection and use
best practices to prevent it.

 

[David Segall]

I am an industrial designer trying to set up a website that would allow
my clients to login securely and access files for downloading. I am
comfortable with HTML and JavaScript, but want something secure, I have
messed about with some ASP scripts, but have not really got what I
want, basically I would like to be able to setup multiple usernames and
passwords that when entered would display a directory tree in the
browser window and allow files to be downloaded.

If you really need the set up you have specified I suggest you use
Visual Web Developer Express Edition
<http://msdn.microsoft.com/vstudio/express/vwd/> to help you write it.
A simpler idea would be to use an ftp server. Internet Explorer
includes the ability to go to a password protected URL of the form
ftp://example.com and drag and drop from the remote directory to a
local one and vice versa. I don't know if other browsers can be used
this way. Even simpler would be to email your clients with the URL of
their password protected .zip file which is sitting, otherwise
unprotected, on your web site.

 

[Toby Inkster]

basically I would like to be able to setup multiple usernames and
passwords that when entered would display a directory tree in the
browser window and allow files to be downloaded.

If you want to do it really simply and easily, probably the best thing to
do would be to create a directory for your protected files, password
protect it using HTTP Basic authentication, and turn on directory
listings, then put all your files into that directory (and you can create
subdirectories too).

Using Apache, that's pretty simple -- just create your directory, and put
a file called ".htaccess" into it, containing the following lines:

Options +Indexes
AuthType Basic
AuthName example.net
AuthUserFile /path/to/password/file.txt
Require valid-user

Then create the password file, which consists of lines like this:

someuser:tR40ZxFCZTntl
anotheruser:EyUsGr3L4VF.M

Note here that the passwords for 'someuser' and 'anotheruser' are actually
'password' and 'foo', but they are stored in the file encrypted for extra
security. To encrypt a password, use either the "htpasswd" program, or an
online tool like this <http://www.rekka.net/cgi-bin/htpasswd.cgi>.

As you appear to be using IIS instead of Apache, the exact procedure will
differ, but IIS certainly has a directory listing facility, and supports
HTTP Basic authentication, which is what's important.

 

[ronthemon]

thank you all for your comments and suggestions, I will go with the ftp
route, easiest for me, thought the hppt access sounds like a good
solution as well.

Again thank you for all your help and suggestions.