Answers.Body: <p>I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page.</p>
  
  <blockquote>
    <p><strong>Disclaimer:</strong> This example was built using the <a href="https://github.com/lindseydiloreto/craft-businesslogic">Business Logic plugin template</a>.</p>
  </blockquote>
  
  <p>There are many ways to manage your password, but it sounds like you'll want something as simple as a Global field. Create a Global field for your password, and keep track of the <strong>Global Set ID</strong> and the <strong>field handle</strong> (you'll need that info in a minute).</p>
  
  <p>On your secure page, you'll want something like this:</p>
  
  <pre class="lang-html prettyprint-override"><code>{% if craft.businessLogic.accessGranted %}
  
      &lt;!-- Your page content goes here --&gt;
  
  {% else %}
  
      &lt;h1&gt;Enter your access code:&lt;/h1&gt;
      {% if error is defined %}
          &lt;p class="error"&gt;{{ error }}&lt;/p&gt;
      {% endif %}
      &lt;form method="post" action="" accept-charset="UTF-8"&gt;
          &lt;input type="hidden" name="action" value="businessLogic/authorize"&gt;
          &lt;input type="text" name="pw" value=""&gt;
          &lt;input type="submit" value="Log In"&gt;
      &lt;/form&gt;
  
  {% endif %}
  </code></pre>
  
  <p>Upon submitting that form, your plugin's <strong>Controller</strong> will authenticate the user, and set a cookie to remember the user.</p>
  
  <p>Something like this for your plugin's Controller:</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  namespace Craft;
  
  class BusinessLogicController extends BaseController
  {
      protected $allowAnonymous = true;
  
      // Login authorization action
      public function actionAuthorize()
      {
          // Get password
          $pwSubmitted = craft()-&gt;request-&gt;getPost('pw');
  
          // Check access
          if ($this-&gt;_validPassword($pwSubmitted)) {
  
              // Set access cookie
              $expires = time() + (60*60*24*7); // One week
              setcookie(md5('cookieNameToBeHashed'), 1, $expires, '/');
  
              // Redirect
              $this-&gt;redirect(craft()-&gt;request-&gt;getPath());
  
          } else {
  
              // Output error message
              craft()-&gt;urlManager-&gt;setRouteVariables(array(
                  'error' =&gt; 'Invalid access code'
              ));
  
          }
  
      }
  
      // Check if password is valid
      private function _validPassword($pwSubmitted)
      {
          // Get global set
          $globalSet = craft()-&gt;globals-&gt;getSetById(156);
  
          // Get target password
          $pwTarget = $globalSet-&gt;passwordFieldhandle;
  
          // Return whether password matches
          return ($pwSubmitted === $pwTarget);
      }
  
  }
  </code></pre>
  
  <p>Your plugin's <strong>Variable</strong> can check if the user is already authorized.</p>
  
  <p>Something like this for your plugin's Variable:</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  namespace Craft;
  
  class BusinessLogicVariable
  {
  
      // Check if access cookie is set
      public function accessGranted()
      {
          $cookieName = md5('cookieNameToBeHashed');
          return array_key_exists($cookieName, $_COOKIE);
      }
  
  }
  </code></pre>
  
  <p>Which of course, brings it full circle. Your secure page will check if <code>accessGranted</code> before showing either the secure content, or the login form.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-02-24T19:02:04.503Z
Answers.Text: Great little plugin this is, thanks Lindsey!
Answers.UserDisplayName: carlcs
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-02-24T20:04:13.020Z
Answers.Text: Thanks @carlcs! I would probably just bundle this up into a ready-to-go plugin, but there are way too many unique use-cases for something along these lines.
Answers.UserDisplayName: Lindsey D
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-24T21:17:16.333Z
Answers.Text: wonderfully simple approach.
Answers.UserDisplayName: Niall Thompson
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-02-24T18:39:19.977Z
Answers.LastActivityDate: 2015-03-30T12:23:16.540Z
Answers.LastEditDate: 2015-03-30T12:23:16.540Z
Answers.UserDisplayName: Lindsey D
Answers.Body: <p>The easiest way I have found to password protect page content is as follows:</p>
  
  <pre><code>{% if craft.request.getParam('password') == 'password_you_want' %}
      &lt;h2&gt;This is your content&lt;/h2&gt;
  {% else %}
      &lt;h2&gt;Not authorized&lt;/h2&gt;
      &lt;form action="{{ craft.request.getUrl() }}" method="POST" accept-charset="utf-8" class="form-inline"&gt;
          {{ getCsrfInput() }}
          &lt;input type="password" name="password" value=""&gt;
          &lt;button type="submit"&gt;Submit&lt;/button&gt;
      &lt;/form&gt;
  {% endif %}
  </code></pre>
  
  <p>You put your password protected content in the first half of the if loop and the second half of the loop appears the first time you load the page; prompting you with a password form that resubmits to the same page looking for the correct 'password_you_want'.</p>
  
  <p>Sometimes simple is best.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-31T21:15:47.590Z
Answers.Text: @Jozo: I'd recommend you [ask a new question](http://craftcms.stackexchange.com/questions/ask) about that, since the answer is probably too long to put into comments. Feel free to link back to this thread for reference.
Answers.UserDisplayName: Lindsey D
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-01T14:51:43.497Z
Answers.Text: The "password_you_want" could be set within a text field of the entry itself.
Answers.UserDisplayName: Allan Kukral
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-14T18:42:50.490Z
Answers.LastActivityDate: 2015-08-15T15:51:11.890Z
Answers.LastEditDate: 2015-08-15T15:51:11.890Z
Answers.UserDisplayName: Allan Kukral
Answers.Body: <p>I’ve done this a few times before and this is how I usually get it done.</p>
  
  <p><strong>Set Per Entry Password</strong></p>
  
  <p>Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever.</p>
  
  <p><strong>Create a Login Template</strong></p>
  
  <p>In Craft, set up a route to the login template including the slug of the page you are password protecting. For example, blog/{slug}/login.</p>
  
  <p>Within your login template create a form that:</p>
  
  <ul>
  <li>Contains a field for your password</li>
  <li>Posts to itself</li>
  </ul>
  
  <p>It should look something like this:</p>
  
  <pre><code>&lt;form id="check-code" action="/{{ craft.request. getPath() }}" method="POST"&gt;
      &lt;input type="text" name="access-code" id="access-code" /&gt;
      &lt;input type="submit" value="Submit" class="submit" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p><strong>Check Form Submission against Entry’s Password</strong></p>
  
  <p>Within the login template wrap the form in a conditional that checks for the password field’s POST value when the page is reloaded following successful form submission (I use Parsley for pre-submission form validation).</p>
  
  <pre><code>    {% if craft.request.getPost('access-code') %}
  
      {% else %}
  
          &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
              …
          &lt;/form&gt;
  
      {% endif %}
  </code></pre>
  
  <p>Now, select the entry using craft.request.getSegment() and compare its password field against the post data from our form submission. If they don’t match then create a duplicate of our form from below with some kind of error message (I’m sure there’s a way to include the forms, without repeating markup using a macro or something). This allows the user to try again if they got it wrong.</p>
  
  <pre><code>    {% if craft.request.getPost('access-code') %}
  
          {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}
  
          {% if entry.passwordField == craft.request.getPost('access-code') %}    
  
          {% else %}
  
              &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
                  &lt;p&gt;Your access code was incorrect&lt;/p&gt;
                  &lt;input type="text" name="access-code" id="access-code" /&gt;
                  &lt;input type="submit" value="Submit" /&gt;
              &lt;/form&gt;
  
          {% endif %}
  
      {% else %}
  
          &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
              …
          &lt;/form&gt;
  
      {% endif %}
  </code></pre>
  
  <p>Now, if the password and the post data do much we need to set a cookie and redirect the user to the entry’s template. In order to set the cookie, I’m using Andrew Welch’s <a href="https://github.com/khalwat/cookies" rel="nofollow noreferrer">Cookies plugin</a>. In this case I’m setting the cookie to expire with the current browser session, but you can set it to be whatever you want following <a href="http://php.net/manual/en/function.setcookie.php" rel="nofollow noreferrer">PHP’s set cookie parameters</a>.</p>
  
  <pre><code>    {% if craft.request.getPost('access-code') %}
  
          {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}
  
          {% if entry.passwordField == craft.request.getPost('access-code') %}
  
              {{ setCookie( craft.request.getSegment(2), entry.passwordField, 0, "/") }}
              {% redirect "blog/"~craft.request.getSegment(2) %}
  
          {% else %}
  
              &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
                  …
              &lt;/form&gt;
  
          {% endif %}
  
      {% else %}
  
          &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
              …
          &lt;/form&gt;
  
      {% endif %}
  </code></pre>
  
  <p><strong>Check for Cookie in Entry’s template</strong></p>
  
  <p>At the top of your entry template check if the entry has a password set and if the browser does not have a cookie set, whose name matches the entry’s slug and whose value matches the entry’s password. If those conditions are met then the user has not logged in and will be redirected to the login page. Otherwise, the template will continue loading and the user will see the entry template.</p>
  
  <pre><code>{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) %}
  
      {% redirect "blog/"~entry.slug~"/login" %}
  
  {% endif %}
  </code></pre>
  
  <p><strong>Bonus</strong></p>
  
  <p>Once you’ve tested out that this process is working you, or other credentialed site users, may not want to have to enter in the password each time. Simply add another conditional to the entry template’s password/cookie check.</p>
  
  <pre><code>{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) and (currentUser == false) %}
  
      {% redirect "blog/"~entry.slug~"/login" %}
  
  {% endif %}
  </code></pre>
  
  <p>Now, if the user is logged in to the site the conditional will be bypassed and they will be able to see the content without getting redirected to the login page.</p>
  
  <p>This is pulled from a <a href="https://noahread.net/blog/create-password-protected-pages-in-craft" rel="nofollow noreferrer">blog post</a> I wrote a while ago.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-12-01T15:13:59.343Z
Answers.LastActivityDate: 2017-12-01T15:13:59.343Z
Answers.UserDisplayName: noahread
Body: <p>Is it possible to protect a page with a single password? Instead of using crafts user features, can I allow an admin to set a specific password from the edit page? When a user visits that page, they have to type in that password to view its content. </p>
  
  <p>We aren't protecting anything that requires a high level of security. But we would like to prohibit access from any old visitor. </p>
  
  <p>One possibility I'm considering is to have a password text field associated with that entry. Then when the user submit the login form, we can do a simple logic check to see if the password is valid. If so, we can set a “logged-in” status to either a PHP session or a cookie. </p>
  
  <p><a href="https://github.com/lewisjenkins/craft-lj-cookies">https://github.com/lewisjenkins/craft-lj-cookies</a></p>
  
  <p><a href="https://github.com/stuartalexwhitehead/remember">https://github.com/stuartalexwhitehead/remember</a></p>
  
  <p>I wonder if anyone else in the Craft community has tried to implement something like this. </p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-02-24T03:49:41.367Z
Comments.Text: Sorry if I'm being master of the obvious, but wouldn't it be easiest to just set up a dummy user account in a group with otherwise very limited access, that you can give out freely.
Comments.UserDisplayName: Douglas McDonald
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-02-24T10:27:14.373Z
Comments.Text: Yep, *"set up a dummy user account"* is probably the easiest way, but not possible without a Craft Pro licence.
Comments.UserDisplayName: carlcs
Tags: <plugins><password><login>
Title: Protect a page with a single password?
ThreadText: # Protect a page with a single password?
  
  (Asked by: username_0 on 2015-02-24)
  
  Is it possible to protect a page with a single password? Instead of using crafts user features, can I allow an admin to set a specific password from the edit page? When a user visits that page, they have to type in that password to view its content.
  
  We aren't protecting anything that requires a high level of security. But we would like to prohibit access from any old visitor.
  
  One possibility I'm considering is to have a password text field associated with that entry. Then when the user submit the login form, we can do a simple logic check to see if the password is valid. If so, we can set a “logged-in” status to either a PHP session or a cookie.
  
  <https://github.com/lewisjenkins/craft-lj-cookies>
  
  <https://github.com/stuartalexwhitehead/remember>
  
  I wonder if anyone else in the Craft community has tried to implement something like this.
  
  **Tags:** plugins, password, login
  
  > **Comments:**
  > **username_1**: Sorry if I'm being master of the obvious, but wouldn't it be easiest to just set up a dummy user account in a group with otherwise very limited access, that you can give out freely.  
  > **username_2**: Yep, *"set up a dummy user account"* is probably the easiest way, but not possible without a Craft Pro licence.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2015-02-24. Score: 18
  
  I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page.
  
  > **Disclaimer:** This example was built using the [Business Logic plugin template](https://github.com/lindseydiloreto/craft-businesslogic).
  
  There are many ways to manage your password, but it sounds like you'll want something as simple as a Global field. Create a Global field for your password, and keep track of the **Global Set ID** and the **field handle** (you'll need that info in a minute).
  
  On your secure page, you'll want something like this:
  
  ```html
  {% if craft.businessLogic.accessGranted %}
  
      <!-- Your page content goes here -->
  
  {% else %}
  
      <h1>Enter your access code:</h1>
      {% if error is defined %}
          <p class="error">{{ error }}</p>
      {% endif %}
      <form method="post" action="" accept-charset="UTF-8">
          <input type="hidden" name="action" value="businessLogic/authorize">
          <input type="text" name="pw" value="">
          <input type="submit" value="Log In">
      </form>
  
  {% endif %}
  
  ```
  
  Upon submitting that form, your plugin's **Controller** will authenticate the user, and set a cookie to remember the user.
  
  Something like this for your plugin's Controller:
  
  ```php
  <?php
  namespace Craft;
  
  class BusinessLogicController extends BaseController
  {
      protected $allowAnonymous = true;
  
      // Login authorization action
      public function actionAuthorize()
      {
          // Get password
          $pwSubmitted = craft()->request->getPost('pw');
  
          // Check access
          if ($this->_validPassword($pwSubmitted)) {
  
              // Set access cookie
              $expires = time() + (60*60*24*7); // One week
              setcookie(md5('cookieNameToBeHashed'), 1, $expires, '/');
  
              // Redirect
              $this->redirect(craft()->request->getPath());
  
          } else {
  
              // Output error message
              craft()->urlManager->setRouteVariables(array(
                  'error' => 'Invalid access code'
              ));
  
          }
  
      }
  
      // Check if password is valid
      private function _validPassword($pwSubmitted)
      {
          // Get global set
          $globalSet = craft()->globals->getSetById(156);
  
          // Get target password
          $pwTarget = $globalSet->passwordFieldhandle;
  
          // Return whether password matches
          return ($pwSubmitted === $pwTarget);
      }
  
  }
  
  ```
  
  Your plugin's **Variable** can check if the user is already authorized.
  
  Something like this for your plugin's Variable:
  
  ```php
  <?php
  namespace Craft;
  
  class BusinessLogicVariable
  {
  
      // Check if access cookie is set
      public function accessGranted()
      {
          $cookieName = md5('cookieNameToBeHashed');
          return array_key_exists($cookieName, $_COOKIE);
      }
  
  }
  
  ```
  
  Which of course, brings it full circle. Your secure page will check if `accessGranted` before showing either the secure content, or the login form.
  
  > **Comments:**
  > **username_2**: Great little plugin this is, thanks username_3!  
  > **username_3**: Thanks @username_2! I would probably just bundle this up into a ready-to-go plugin, but there are way too many unique use-cases for something along these lines.  
  > **username_4**: wonderfully simple approach.  
  
  ---
  
  ### Answer by username_5 on 2015-08-14. Score: 13
  
  The easiest way I have found to password protect page content is as follows:
  
  ```
  {% if craft.request.getParam('password') == 'password_you_want' %}
      <h2>This is your content</h2>
  {% else %}
      <h2>Not authorized</h2>
      <form action="{{ craft.request.getUrl() }}" method="POST" accept-charset="utf-8" class="form-inline">
          {{ getCsrfInput() }}
          <input type="password" name="password" value="">
          <button type="submit">Submit</button>
      </form>
  {% endif %}
  
  ```
  
  You put your password protected content in the first half of the if loop and the second half of the loop appears the first time you load the page; prompting you with a password form that resubmits to the same page looking for the correct 'password\_you\_want'.
  
  Sometimes simple is best.
  
  > **Comments:**
  > **username_3**: @Jozo: I'd recommend you [ask a new question](http://craftcms.stackexchange.com/questions/ask) about that, since the answer is probably too long to put into comments. Feel free to link back to this thread for reference.  
  > **username_5**: The "password_you_want" could be set within a text field of the entry itself.  
  
  ---
  
  ### Answer by username_6 on 2017-12-01. Score: 3
  
  I’ve done this a few times before and this is how I usually get it done.
  
  **Set Per Entry Password**
  
  Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever.
  
  **Create a Login Template**
  
  In Craft, set up a route to the login template including the slug of the page you are password protecting. For example, blog/{slug}/login.
  
  Within your login template create a form that:
  
  * Contains a field for your password
  * Posts to itself
  
  It should look something like this:
  
  ```
  <form id="check-code" action="/{{ craft.request. getPath() }}" method="POST">
      <input type="text" name="access-code" id="access-code" />
      <input type="submit" value="Submit" class="submit" />
  </form>
  
  ```
  
  **Check Form Submission against Entry’s Password**
  
  Within the login template wrap the form in a conditional that checks for the password field’s POST value when the page is reloaded following successful form submission (I use Parsley for pre-submission form validation).
  
  ```
      {% if craft.request.getPost('access-code') %}
  
      {% else %}
  
          <form action="/{{ craft.request. getPath() }}" method="POST">
              …
          </form>
  
      {% endif %}
  
  ```
  
  Now, select the entry using craft.request.getSegment() and compare its password field against the post data from our form submission. If they don’t match then create a duplicate of our form from below with some kind of error message (I’m sure there’s a way to include the forms, without repeating markup using a macro or something). This allows the user to try again if they got it wrong.
  
  ```
      {% if craft.request.getPost('access-code') %}
  
          {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}
  
          {% if entry.passwordField == craft.request.getPost('access-code') %}    
  
          {% else %}
  
              <form action="/{{ craft.request. getPath() }}" method="POST">
                  <p>Your access code was incorrect</p>
                  <input type="text" name="access-code" id="access-code" />
                  <input type="submit" value="Submit" />
              </form>
  
          {% endif %}
  
      {% else %}
  
          <form action="/{{ craft.request. getPath() }}" method="POST">
              …
          </form>
  
      {% endif %}
  
  ```
  
  Now, if the password and the post data do much we need to set a cookie and redirect the user to the entry’s template. In order to set the cookie, I’m using Andrew Welch’s [Cookies plugin](https://github.com/khalwat/cookies). In this case I’m setting the cookie to expire with the current browser session, but you can set it to be whatever you want following [PHP’s set cookie parameters](http://php.net/manual/en/function.setcookie.php).
  
  ```
      {% if craft.request.getPost('access-code') %}
  
          {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}
  
          {% if entry.passwordField == craft.request.getPost('access-code') %}
  
              {{ setCookie( craft.request.getSegment(2), entry.passwordField, 0, "/") }}
              {% redirect "blog/"~craft.request.getSegment(2) %}
  
          {% else %}
  
              <form action="/{{ craft.request. getPath() }}" method="POST">
                  …
              </form>
  
          {% endif %}
  
      {% else %}
  
          <form action="/{{ craft.request. getPath() }}" method="POST">
              …
          </form>
  
      {% endif %}
  
  ```
  
  **Check for Cookie in Entry’s template**
  
  At the top of your entry template check if the entry has a password set and if the browser does not have a cookie set, whose name matches the entry’s slug and whose value matches the entry’s password. If those conditions are met then the user has not logged in and will be redirected to the login page. Otherwise, the template will continue loading and the user will see the entry template.
  
  ```
  {% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) %}
  
      {% redirect "blog/"~entry.slug~"/login" %}
  
  {% endif %}
  
  ```
  
  **Bonus**
  
  Once you’ve tested out that this process is working you, or other credentialed site users, may not want to have to enter in the password each time. Simply add another conditional to the entry template’s password/cookie check.
  
  ```
  {% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) and (currentUser == false) %}
  
      {% redirect "blog/"~entry.slug~"/login" %}
  
  {% endif %}
  
  ```
  
  Now, if the user is logged in to the site the conditional will be bypassed and they will be able to see the content without getting redirected to the login page.
  
  This is pulled from a [blog post](https://username_6.net/blog/create-password-protected-pages-in-craft) I wrote a while ago.
  
  
  ---
  
  