Web Security, Privacy and Commerce, 2nd Edition

Chapter 20. Controlling Access to Your Web Content

Organizations run web servers because they are an easy way to distribute information to people on the Internet. But sometimes you don't want to distribute your information to everybody. For instance, you might have:

• Information on your web server intended only for employees of your organization

• An electronic publication that contains articles that are only available to customers who have paid a monthly subscription fee.

• Confidential technical information that is only for customers who have signed nondisclosure agreements

• A web-based interface to your order-entry system that is open to preauthorized users, but should not be open to the general public

These scenarios have different access control requirements. Fortunately, today's web servers have a variety of ways to restrict access to information.