How to prevent a user from directly accessing my html page

Question

I have a login page that sends a request to a Python script to authenticate the user. If it's not authenticated it redirects you to the login page. If it is redirects you to a HTML form. The problem is that you can access the HTML form by writing the URL. How Can I make sure the user came from the login form with my Python script without using modules because I can't install anything in my server. I want it to be strictly with Python I can't use PHP. Is it possible? Can I use other methods to accomplish the task?

Answer 1

It's apparent to me that you only want to use Python, no frameworks etc... So the problem is that you are actually redirecting to an existing web HTML page. Don't do that, instead serve the HTML with Python itself.

# pages.py
class DefaultPage(object):
    def __init__(self):
        self.html = '''
        All Your HTML Here
        '''
    def self.display:
        return self.html

Obviously your using something to serve your Python, I'm assuming something simple like Google App Engine Launcher, in which case you can just write the class. Even if your using some other simple WSGI, the concept remains the same.

# main.py
import webapp2
from pages import DefaultPage
class MainHandler(webapp2.RequestHandler):
    def get(self):
        page = DefaultPage()
        self.response.write(page.display())

app = webapp2.WSGIApplication([
    ('/', MainHandler)
], debug=True)

Answer 2

The best method to handle user login is to use tokens as cookies.
After the user successful login generate a token and send it to them , save this token in your "in memory" DB(if you are using something like django server)- https://docs.djangoproject.com/en/1.9/intro/tutorial01/ , it does it for you.
Each time the user access any internal page in your website check the user token which have been sent as a cookie header , if is found in your DB direct him to the requested page , else , direct him to the login page.
I can help you more if you give more details about your server(server type)

Answer 3

What you just asked for is called Session Management. Here's the OWASP guide on it: https://www.owasp.org/index.php/Session_Management

You can use frameworks like Django written in python which already provide this security layer. https://docs.djangoproject.com/en/1.9/topics/http/sessions/

Answer 4

You have to add CSRF protection to disallow form submitting from untrusted sources. Dive into What is a CSRF token ? What is its importance and how does it work? question to understand how it works, also you can take a look on How does a CSRF token prevent an attack.

You can implement own csrf protection logic or use existing one like Django CSRF or Flask CSRF Protection etc.( it depends on technologies used on your project).

Answer 5

Make sure to check the "referer" header in Python, and validate that the address is your login page.