0

I want to block a specific user to access my website. I know it is not possible with Dynamic IP. Is there any other alternate to block the specific user to access website? I'm currently at APACHE LINUX based server. The user manages web account at my website. I'm managing a user account on PHP with $_SESSION variables. The user are authenticated using login and password just like any shopping cart website.

4
  • what do you mean by "user"? a physical person? an account on certain client-machine? a unique account on a set of client machines? a client machine? an account on a website? an account on your website? you will find it impossible to block most of these (with the exception of "an account on your website")
    – umläute
    Jul 24, 2012 at 7:49
  • it would be great if you could elaborate a bit on that. since you say that you are using apache on linux, i assume that this is all you use (no CMS or the like); how do your users authenticate? using .htpasswd? please post a configuration example that explains what userA, userX and anonymous are supposed to see
    – umläute
    Jul 24, 2012 at 7:57
  • I'm just authenticating users based on their login and password. Its just a simple shopping cart.
    – fawad
    Jul 24, 2012 at 8:07
  • i still don't know where your users come from (that is: how the login credentials are stored on your server), and who does the actual authentication. it guess that you are not using apache's .htaccess mechanisms, but instead you are using php that queries a database. in this case, simply generate a "forbidden" site whenever the user is not allowed to access a given part of your portal. also, this is not related to linux or apache, but rather to php. i would highly recommend using one of the existing frameworks to build web-applications rather than trying to cook your own.
    – umläute
    Jul 24, 2012 at 8:29

2 Answers 2

0

Unless the user has to log in, you have no way of knowing who is accessing your site if he's on a dynamic ip address. The only mechanism I can think of is to check any cookie that identifies the user that you've already placed on his system. This wouldn't of course stop them from accessing your site from a different machine.

Long story short - unless the user has to log in first of all, or you have some other means (cookie?) of identifying the user, then not that I know of.

0
0

can be achieved by .htaccess to block a specific ip,

order allow,deny deny from 127.0.0.1 allow from all

or use this to block a complete range of ip,

deny from 127.0.0

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.