Perl with FastCGI authorization example

Perl with FastCGI authorization example:

#!/usr/bin/perl

use strict;

use DBI;

use FCGI;

use constant PATH_NEVER  => 0;

use constant PATH_MAYBE  => 1;

use constant PATH_ALWAYS => 2;

# normally, I would abstract this stuff out into a sitewide config module,

# but for didactic reasons, I’ll just define some constants here:

use constant COOKIE_NAME => ‘AUTH_TOKEN’;

use constant DBI_DSN     => ‘dbi:mysql:hostname=DBHOSTNAME;database=DBNAME’;

use constant DBI_USR     => ‘monty’;

use constant DBI_PWD     => ‘widenius’;

use constant AUTH_ERR => -1;

use constant AUTH_NOK =>  0;

use constant AUTH_OK  =>  1;

use constant AUTH_QUERY => <<AQ_SQL;

select count(*) as authorized

from   login_table

where  user  = ?

and    token = ?

and    expiry > unix_timestamp()

AQ_SQL

use vars qw($DBH $STH $N);

sub _init ();

sub _exit ();

sub authorized ($$$);

sub get_login_cookie ();

sub query_decode (;@);

_init();

for ($N = 0; FCGI::accept() >= 0; $N++)

{

    # check the path to see if we want/need to authorize access:

    my $path_auth = check_path($ENV{REQUEST_URI});

    if($path_auth == PATH_MAYBE)

    {

        my $auth = undef();

        my $user;

        my $token;

        my $cookie;

        # get the login cookie and decompose it into user + token:

        # cookie format: USERNAME:OPAQUETOKENFROMDB

        $cookie = get_login_cookie();

        ($user,$token) = split(/:/,$cookie,2);

        # check to see if an unexpired entry exists in the db:

        $auth = authorized($STH, $user, $token);

        if($auth == AUTH_OK)

        {

            # return 200 Ok, and set the AUTH_USER_NAME env variable

            # in case there is a dynamic content generator:

            # variables you want to set for the requested script/page

            # need to be prefixed w. the string ‘Variable-’,

            # or they will be passed back to the client, not the server.

            print(STDOUT “Status: 200 Authorized\r\n”);

            print(STDOUT “Variable-AUTH_USER_NAME: $user\r\n”);

            print(STDOUT “\r\n”);

        }

        elsif($auth == AUTH_NOK)

        {

            # Not authorized.

            # You can make your login page the default

            # 401 page with the htaccess ErrorDocument 401 directive:

            print(STDOUT “Status: 401 Not Authorized\r\n”);

            print(STDOUT “WWW-Authenticate: basic realm=\”foo\”\r\n”);

            print(STDOUT “\r\n”);

        }

        else

        {

            # Waah. Something blew up.

            print(STDOUT “Status: 500 Internal Auth Error\r\n”);

            print(STDOUT “\r\n”);

        }

    }

    elsif($path_auth == PATH_NEVER)

    {

        # we never allow anyone in to these:

        print(STDOUT “Status: 403 Denied\r\n”);

        print(STDOUT “\r\n”);

    }

    elsif($path_auth == PATH_ALWAYS)

    {

        # these we don’t really care about, just let them in.

        # your error pages, icon, etc should all fall into this

        # category, as should your login page:

        print(STDOUT “Status: 200 Ok\r\n”);

        print(STDOUT “\r\n”);

    }

    else

    {

        # This should not be able to happen: If it does,

        # your site needs attention from you:

        print(STDOUT “Status: 500 Internal Auth Error\r\n”);

        print(STDOUT “\r\n”);

    }

}

_exit();

##############

# Access rules, first match wins:

# /auth/login.cgi is always allowed

# /share

create table login_table (token  char(32) not null,

                          user   char(32) not null,

                          expiry int(11)  not null)