HOW DO I CREATE A PASSWORD PROTECTED PROJECT USING BOOTSTRAP

[iqiuhk]

I am currently coding out a portfolio website using bootstrap and would like protect some of my projects with passwords but im not sure how to, can someone help me with this please thank you!!

 

[davidktw]

I am currently coding out a portfolio website using bootstrap and would like protect some of my projects with passwords but im not sure how to, can someone help me with this please thank you!!

If you are trying to create a credential protected site, you better understand the fundamentals of how session works first. A simple HTML page with a form for submission will work. There are a lot of things you need to know to create a secure site that requires users to login
1) Form submission
2) Session management (cookie etc)
3) server side validation of password
4) credential storage into database
5) Whole lot of security implications

If you don't have the necessary skill set, stick with solutions like Joomla, Wordpress etc that already provided login for you.
I understand you are doing for portfolio, but without a robust understanding, your portfolio is more likely to reveal your deficiencies rather than promoting your value.

Bootstrap is just a frontend styling framework. Any framework will work on top of what I just shared.
There are tons of such login form styling information online
https://mdbootstrap.com/docs/standard/extended/login/but none of them will introduce to you proper authentication concepts because it is a topic not related to bootstrap, not even Angular/React.

Here is a non-fancy rudimentary PHP approach to get you started
https://levelup.gitconnected.com/how-to-build-a-secure-login-page-in-php-954f51d08701

 

[Phen8210]

I am currently coding out a portfolio website using bootstrap and would like protect some of my projects with passwords but im not sure how to, can someone help me with this please thank you!!

Yes, I can help you with that!

One way to protect your projects with passwords is to use a server-side programming language like PHP to check if the entered password matches a predefined password, and only show the project content if the passwords match. Here's a simple example:

1. Create a PHP file for each protected project, for example, project1.php, project2.php, etc.
2. At the top of each PHP file, define a variable to hold the correct password for that project, for example:

<?php
$correct_password = "mypassword";
?>

1. Use a form to prompt the user for a password. The form should submit to the same PHP file, and use the POST method. Here's an example of what the form might look like:

<form method="post">
<label for="password">Enter the password to view this project:</label>
<input type="password" name="password" id="password">
<input type="submit" value="Submit">
</form>

1. In the PHP file, check if the submitted password matches the correct password, and only show the project content if the passwords match. Here's an example:

<?php
if (isset($_POST["password"]) && $_POST["password"] == $correct_password) {
// Show the project content here
} else {
// Show an error message or a login form
}
?>

That's it! With this method, only users who know the correct password will be able to access the protected project content. Keep in mind that this is a very basic example and there are more secure and sophisticated methods of password protection available.


Source: ChatGPT

 

[davidktw]

Yes, I can help you with that!

One way to protect your projects with passwords is to use a server-side programming language like PHP to check if the entered password matches a predefined password, and only show the project content if the passwords match. Here's a simple example:

1. Create a PHP file for each protected project, for example, project1.php, project2.php, etc.
2. At the top of each PHP file, define a variable to hold the correct password for that project, for example:

<?php
$correct_password = "mypassword";
?>

1. Use a form to prompt the user for a password. The form should submit to the same PHP file, and use the POST method. Here's an example of what the form might look like:

<form method="post">
<label for="password">Enter the password to view this project:</label>
<input type="password" name="password" id="password">
<input type="submit" value="Submit">
</form>

1. In the PHP file, check if the submitted password matches the correct password, and only show the project content if the passwords match. Here's an example:

<?php
if (isset($_POST["password"]) && $_POST["password"] == $correct_password) {
// Show the project content here
} else {
// Show an error message or a login form
}
?>

That's it! With this method, only users who know the correct password will be able to access the protected project content. Keep in mind that this is a very basic example and there are more secure and sophisticated methods of password protection available.


Source: ChatGPT

ChatGPT didn’t at least suggest you to hash and salt the password?

 

[Phen8210]

ChatGPT didn’t at least suggest you to hash your password?

i didnt even read the output

too basic liao this

 

[davidktw]

i didnt even read the output

too basic liao this

Which is too basic ?

It will unfortunate if anyone follows what ChatGPT suggest.

 

[Phen8210]

Which is too basic ?

It will unfortunate if anyone follows what ChatGPT suggest.

I think if it provides a flawless answer I will be unfortunate instead.

 

[davidktw]

I think if it provides a flawless answer I will be unfortunate instead.

Well keep going at it, one day it will.

 

[davidktw]

Which is too basic ?

It will unfortunate if anyone follows what ChatGPT suggest.

Why @Dr.Vijay ? Is there any particular thing you are exclaiming to on why I say that?

1) No one does that for password authentication, not a static variable in the page.
2) Someone whom is clueless about authentication would thought that is a feasible approach. I won’t expect someone whom ask such a question would knows we normally uses database, or file, or ldap for credential storage or maybe even something like OAuth/SAML etc.
3) Even if that someone is capable of realising that a storage solution is required for more than 1 user, i highly doubt he/she will be able to realise one is highly recommended not to store the password in clear even of the storage is secured. One should resort to hashing and one will also want to use salted password instead of as-is to avoid same hash produced.

All in all, this is the reason why I find AI used in coding is detrimental to the ecosystem. It may look like a helper for the well learnt, but would seemingly be enslaving the newborn.

 

[Phen8210]

Why @Dr.Vijay ? Is there any particular thing you are exclaiming to on why I say that?

1) No one does that for password authentication, not a static variable in the page.
2) Someone whom is clueless about authentication would thought that is a feasible approach. I won’t expect someone whom ask such a question would knows we normally uses database, or file, or ldap for credential storage or maybe even something like OAuth/SAML etc.
3) Even if that someone is capable of realising that a storage solution is required for more than 1 user, i highly doubt he/she will be able to realise one is highly recommended not to store the password in clear even of the storage is secured. One should resort to hashing and one will also want to use salted password instead of as-is to avoid same hash produced.

All in all, this is the reason why I find AI used in coding is detrimental to the ecosystem. It may look like a helper for the well learnt, but would seemingly be enslaving the newborn.

Yup, the PW stored in the DB mustn't be stored as it is, as the scenario of a security breach would cause major problems.

Although, I would like to think that any aspiring developers surely will realize that information like passwords are not supposed to be stored as it is. Even people that aren't developers would know that it is unsafe to store passwords as it is.

Furthermore, chatGPT stated, 'Keep in mind that this is a very basic example, and there are more secure and sophisticated methods of password protection available.'

chatGPT output to me, is fine as a starting point for beginners to learn about authentication concepts. Whether a person wants to dig deeper into it and check for potential flaws is honestly up to them.

It may sound like chatGPT is withholding critical information, but are the majority of humans any better in this regard ? Not from my experience.

For beginners, I recommend taking some full-stack courses as common concepts on authentication are usually covered. That's what I did in the past.

 

[davidktw]

Yup, the PW stored in the DB mustn't be stored as it is, as the scenario of a security breach would cause major problems.

Although, I would like to think that any aspiring developers surely will realize that information like passwords are not supposed to be stored as it is. Even people that aren't developers would know that it is unsafe to store passwords as it is.

Furthermore, chatGPT stated, 'Keep in mind that this is a very basic example, and there are more secure and sophisticated methods of password protection available.'

chatGPT output to me, is fine as a starting point for beginners to learn about authentication concepts. Whether a person wants to dig deeper into it and check for potential flaws is honestly up to them.

It may sound like chatGPT is withholding critical information, but are the majority of humans any better in this regard ? Not from my experience.

For beginners, I recommend taking some full-stack courses as common concepts on authentication are usually covered. That's what I did in the past.

No. I think you are overly optimistic in that everyone whom is looking for a way to do something has to eventually jump into the right area where it is proper. In my entire learning process, at no time an answer given by chatgpt is provided as the starting point of the answer. that answer is totally unacceptable in an industrial setting, and someone whom is asking for such a question is not necessarily for academic reason.

If that someone just simply evolve into the stage where a database is necessary and store the password in clear, that would already be a serious security vulnerability. There is no link to jump from a clear text into a salted hash technique. There is only such a link if the person seek the answer from an experience developer whom has done this before, or read up tons of articles in the internet that talks about this topic.

The chances of someone whom is already given tons of codes on how it is done to research from scratch again is low. This is a basic example, chatgpt could have provided a naive complex solution for some other questions and the receiver would have totally skip the research stage and go into implementation right away. This is what i have been observing most people using chatgpt for in code generation. they wanted to skip the research portion of the learning process.

I would rather that on the err side that that someone whom doesn’t know about the topic go thru the hard way to find out and more likely to find out the complexity of the issue and discover more things along the way, instead of just blatantly getting the codes from a source which he/she feels wow about because it can seemingly do wonders and start using any parts of the codes first.

Just this seemingly basic topic is more than meets the eye if one really dig into it. And certainly the answer provided by chatgpt is extremely far from the industrial usage, not to mention given that silly answer, I would have advise that individual using http basic/digest provided by the web server instead of coding it in that silly manner into php, because that password approach doesn’t account for per user session. It is just a global page protection technique. Again there is no tangent at which the user can jump from what the answer provided into the http basic/digest technique which as an experienced software developer can provide.

 

[Phen8210]

thats true

 

[Trader11]

No. I think you are overly optimistic in that everyone whom is looking for a way to do something has to eventually jump into the right area where it is proper. In my entire learning process, at no time an answer given by chatgpt is provided as the starting point of the answer. that answer is totally unacceptable in an industrial setting, and someone whom is asking for such a question is not necessarily for academic reason.

If that someone just simply evolve into the stage where a database is necessary and store the password in clear, that would already be a serious security vulnerability. There is no link to jump from a clear text into a salted hash technique. There is only such a link if the person seek the answer from an experience developer whom has done this before, or read up tons of articles in the internet that talks about this topic.

The chances of someone whom is already given tons of codes on how it is done to research from scratch again is low. This is a basic example, chatgpt could have provided a naive complex solution for some other questions and the receiver would have totally skip the research stage and go into implementation right away. This is what i have been observing most people using chatgpt for in code generation. they wanted to skip the research portion of the learning process.

I would rather that on the err side that that someone whom doesn’t know about the topic go thru the hard way to find out and more likely to find out the complexity of the issue and discover more things along the way, instead of just blatantly getting the codes from a source which he/she feels wow about because it can seemingly do wonders and start using any parts of the codes first.

Just this seemingly basic topic is more than meets the eye if one really dig into it. And certainly the answer provided by chatgpt is extremely far from the industrial usage, not to mention given that silly answer, I would have advise that individual using http basic/digest provided by the web server instead of coding it in that silly manner into php, because that password approach doesn’t account for per user session. It is just a global page protection technique. Again there is no tangent at which the user can jump from what the answer provided into the http basic/digest technique which as an experienced software developer can provide.

I recommend developers to read OWASP cheatsheets at least once

 

[davidktw]

I recommend developers to read OWASP cheatsheets at least once

Read or ingest anything for any questions. Answers are more valuable and meaningful if they are found by oneself with diligence inquisitively.
The journey to discover something has far more reach than simply getting the answer.
Getting the answer is a milestone, but the journey may equip one with more questions that will grow more objectives.

 

[Trader11]

Read or ingest anything for any questions. Answers are more valuable and meaningful if they are found by oneself with diligence inquisitively.
The journey to discover something has far more reach than simply getting the answer.
Getting the answer is a milestone, but the journey may equip one with more questions that will grow more objectives.

Yes. But sometimes you don't know what to ask if you don't have the prerequisites to know the topics. Reading introductory stuff is helpful