Authentication Issue

[KOCHI]

Hi,

I have a secure area for my Website. Its a folder in web server( for example

"http://www.mysite.com/Securefolder/"). INorder to View the folder user must register with

the site. When a user register a new entry is made to ".htpasswd" file in the secure folder

and the username and password is mailed to user.

Here the tough part come. I charge Some amount for registration. Normally what users do is

one will register and pass the username and password to others and they can also access the

secure area. I want to prevent this


So I thought about two options

1. Cookie
2. IP address tracking.



We cannot replay on cookie because , it can be get deleted at any time. The second is IP

address and its also cannot be relayed as most of the users don't have a static IP



CAn Anyone tell me a Possible solution for this issue?.


Thanks in Advance ,


Regards,
KOCHI

[Malcolm]

I'd do a combination of cookies and ip/hostname tracking.

I'd have cookies that would expire after a few hours that would force the user to have the same hostname and IP address.

Now for the hostname and address function I'd make it so that the user must have an IP address in the same subnet block as the one they used to register, along with haveing the same base hostname.

But this wouldn't be good for anyone wanting to, say, login from work. :S