Server-side document protection

[agnitrate]

My grandfather wants me to help him with protecting a document on his web site and I figured I'd ask you guys since I've never done any web-related programming.

Essentially there is a document on his web site that he wants only certain people to have access to after providing a username and password, but I'm not sure how to go about doing this in a secure way. The easiest way would just be to write some java script that has the username and password in the HTML (not secure) that will let you in. I could also just hide the VB code in another file on the server that you would also be able to download were you smart enought to look at the source code (not secure either).

Is there a safe way to maintain this document so the list of usernames and passwords could be maintained as well as reasonably secured on the server? I'm going to google around for a while but I figured some of you guys know this far better than I so I figured it couldn't hurt to ask.

Thanks for any recommendations you can give.

-silver

 

[Nothinman]

It depends on what kind of webserver it is. If it's Apache all you would have to do is drop a .htaccess file in the directory containing the file, in that file would be some Auth directives and the path to a username/password file that you would manange with htpasswd.

 

[n0cmonkey]

.htaccess + mod_ssl

 

[agnitrate]

Thanks for the recommendations guys. Unfortunately his webserver is using IIS (why?!) so I found an ASP password system that sufficed. It still allows people to bookmark the pages once they've passed the password protection, but the information isn't so secure that this is a huge security hole. He was trying to keep a listing of all members in his subdivision with address, phone number, and email in a restricted section of his site, so this should be enough to keep the average user out.

Thanks for the help!

-silver