I would like to build a safe way for users to register and login which enables them to see exclusive content on the site. Essentially a page that is hidden from regular visitors with a custom template and perhaps some subpages.
I have looked at multiple cookbook examples and researched the possibilities but as this is somewhat related to security, I would like to ask for the optimal approach regardless.
The site is hosted in the EU.
The users need to have a registering/login page that grants them access to exclusive content.
I would like to avoid bots making accounts, even though none of the content would be of benefit to them, I would just like to make sure that user creation doesnt create a vulnerability. Also, some highlighting of possible issues with authentication would be much appreciated.
Ofcourse the users also need to be able to log out.
Where should I start my quest?
Very much appreciate any detailed pitfalls and issues that this endeavour might rise.
My client (real estate renting) wants to communicate certain internal news and content to their existing client base on site. But in essence, it would not be bad if in the long term I had that option yes, like preferences.
As far as I can tell, email subscription is not the preferred way of communicating for them with the existing clients so this could become a portal for that, yes.
Ok, as I already wrote above, the cookbook recipe linked above would be your starting point.
If you don’t want just anyone to create an account, you could:
Create new users with a role that does not have any permissions, then your client or their representatives can change the user role to grant access and delete unwanted users.
If your client already has a user list with emails that can be used as a whitelist, you could compare the new sign-up against this email list before an account is created.
You/your client creates accounts upfront with some random password, then allow users to log in with code instead of password.
The second option seems quite good for a starting point. I think a button underneath a failed login attempt that sends a request to the clients inbox would solve the issue of a new user that for some reason isnt part of the whitelist.