User can access internal yaws pages without authentication

Question

I am using the embedded YAWS web-server with yaws cookie session. I first authenticate the user with user-name & password to allow him the entry to the web pages.

My problem is if the user directly opens the internal web page instead of login page he can view it even without the authentication. How to restrict the user that he must have the cookie to view any internal web page.

Answer 1

In chapter 7 of the Yaws PDF documentation there's an example that does exactly what you're asking about. It uses arg rewriting to redirect unauthenticated requests to a login page.

First we configure an arg rewriter module named myapp in the server portion of yaws.conf:

arg_rewrite_mod = myapp

The myapp:arg_rewrite/1 function checks the incoming request via the #arg{} record to look for a specific cookie, and if not found and the request isn't trying to retrieve one of the three resources returned from the login_pages/0 function, it calls do_rewrite/1 to rewrite the request to deliver a login.yaws page instead:

arg_rewrite(Arg) ->
    OurCookieName = "myapp_sid"
    case check_cookie(Arg, OurCookieName) of
        {error, _} ->
            do_rewrite(Arg);
        {ok, _Session} ->
            %% return Arg untouched
            Arg
end.

%% these pages must be shippable without a good cookie
login_pages() ->
    ["/banner.gif", "/login.yaws", "/post_login.yaws"].

do_rewrite(Arg) ->
    Req = Arg#arg.req,
    {abs_path, Path} = Req#http_request.path,
    case lists:member(Path, login_pages()) of
        true ->
            Arg;
        false ->
            Arg#arg{req = Req#http_request{path = {abs_path, "/login.yaws"}},
                    state = Path}
end.

Please see the Yaws PDF documentation for further details.