Login controller with e-mail array

The CMS Questions
1

I use the following controller to allow access to a certain page only with a password, because the e-mail is hardcoded. The password is assigned to a user (client).

<?php

return function ($kirby) {

  if ($kirby->user()) {
    go('/');
  }

  $error = false;

  if ($kirby->request()->is('POST') && get('login')) {

    try {
      $kirby->auth()->login('fake@email.com', get('password'));

      go('service/topsecret');
    } catch (Exception $e) {
      $error = true;
    }
  }

  return [
    'error' => $error
  ];

};

However, the password changes monthly according to the following scheme:

January 2024: topsecret-0124
February 2024: topsecret-0224
…
October 2025: topsecret-0925

As I don’t want to change the password at 11.59 pm at the end of every month, an automatic system would be perfect. But I don’t think that’s possible due to the security restrictions.

My other thought is to create an additional user for the 2-3 following months. But this only works with a different e-mail address. Can I add an array to the controller to store multiple e-mail addresses?

2

I’d use a cron job to change the password according to your scheme then in the controller use the password that fits the current date.

3

Cron jobs are not possible with the hosting package :unamused: I am also not at all familiar with cron jobs.
Is there no way to create an array with different e-mail addresses in the login controller?

4

These email addresses would have to correspond to different users and you would have to loop through all users to check the one that fits. From a security point of view, this would be of no use, because all users/email addresses with the different passwords would be valid. Unless you add another check, what user would be valid at which point in time.

I would think a single user with a regularly changed password would be the better option, though.

5

I suspected that it would fail because of the security restrictions.
With my current solution with only one user, there are two disadvantages:

  • The password always has to be changed manually on the last day of the month.
  • If the new password is valid in Germany at 0.01, users from other continents (e.g. USA) still have to wait hours.

I am therefore not thrilled with my solution for the protected area :thinking:

Plan B: The “User sign-up” cookbook would be too complex and overloaded for this case. And the realization would be associated with additional costs for the customer.

I would think a single user with a regularly changed password would be the better option, though.

Yes! I’ll probably leave the project as it is for now and when I’m more familiar with Kirby I’ll think about another solution.