I'm working on a similar issue with controlling connections to my remote panels. Correct me if I'm wrong, but I think the above solution has some loopholes also. Since the CGI script is generating a new HTML and actually writing it to disk, wouldn't anyone else also be able to connect to this newly page if they new the URL?
For instace:
1) A person logs in from the CGI page.
2) The CGI script builds the remote panel page.
3) At any time thereafter, someone knowing the name of the new webpage can connect to it.
Now this problem could be solved if the newly generated page could be sent directly to the person who has logged in if session variables were used within a single web server. However, since two separate web servers are being
used, this is probably not possible.
If anyone has a solution to this new problem or can refute what I've just said, please let me know. I have been running over how to do use a login system repeatedly without success. I really don't want to default back to using IP addresses to block access since my users will be 1) spread across multiple IP ranges and 2) more than likely unable to provide their own IP addresses if requested.
Thanks,
Pete