Protect a page with a single password? Is it possible to protect a page with a single password? Instead of using crafts user features, can I allow an admin to set a specific password from the edit page? When a user visits that page, they have to type in that password to view its content. 

We aren't protecting anything that requires a high level of security. But we would like to prohibit access from any old visitor. 

One possibility I'm considering is to have a password text field associated with that entry. Then when the user submit the login form, we can do a simple logic check to see if the password is valid. If so, we can set a “logged-in” status to either a PHP session or a cookie. 

https://github.com/lewisjenkins/craft-lj-cookies

https://github.com/stuartalexwhitehead/remember

I wonder if anyone else in the Craft community has tried to implement something like this.
I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page.


  Disclaimer: This example was built using the Business Logic plugin template.


There are many ways to manage your password, but it sounds like you'll want something as simple as a Global field. Create a Global field for your password, and keep track of the Global Set ID and the field handle (you'll need that info in a minute).

On your secure page, you'll want something like this:

{% if craft.businessLogic.accessGranted %}

    &lt;!-- Your page content goes here --&gt;

{% else %}

    &lt;h1&gt;Enter your access code:&lt;/h1&gt;
    {% if error is defined %}
        &lt;p class="error"&gt;{{ error }}&lt;/p&gt;
    {% endif %}
    &lt;form method="post" action="" accept-charset="UTF-8"&gt;
        &lt;input type="hidden" name="action" value="businessLogic/authorize"&gt;
        &lt;input type="text" name="pw" value=""&gt;
        &lt;input type="submit" value="Log In"&gt;
    &lt;/form&gt;

{% endif %}


Upon submitting that form, your plugin's Controller will authenticate the user, and set a cookie to remember the user.

Something like this for your plugin's Controller:

&lt;?php
namespace Craft;

class BusinessLogicController extends BaseController
{
    protected $allowAnonymous = true;

    // Login authorization action
    public function actionAuthorize()
    {
        // Get password
        $pwSubmitted = craft()-&gt;request-&gt;getPost('pw');

        // Check access
        if ($this-&gt;_validPassword($pwSubmitted)) {

            // Set access cookie
            $expires = time() + (60*60*24*7); // One week
            setcookie(md5('cookieNameToBeHashed'), 1, $expires, '/');

            // Redirect
            $this-&gt;redirect(craft()-&gt;request-&gt;getPath());

        } else {

            // Output error message
            craft()-&gt;urlManager-&gt;setRouteVariables(array(
                'error' =&gt; 'Invalid access code'
            ));

        }

    }

    // Check if password is valid
    private function _validPassword($pwSubmitted)
    {
        // Get global set
        $globalSet = craft()-&gt;globals-&gt;getSetById(156);

        // Get target password
        $pwTarget = $globalSet-&gt;passwordFieldhandle;

        // Return whether password matches
        return ($pwSubmitted === $pwTarget);
    }

}


Your plugin's Variable can check if the user is already authorized.

Something like this for your plugin's Variable:

&lt;?php
namespace Craft;

class BusinessLogicVariable
{

    // Check if access cookie is set
    public function accessGranted()
    {
        $cookieName = md5('cookieNameToBeHashed');
        return array_key_exists($cookieName, $_COOKIE);
    }

}


Which of course, brings it full circle. Your secure page will check if accessGranted before showing either the secure content, or the login form.