Revo secure members area on new site

Hi chaps,

Trust everyone is well!

I have a new site coming up which needs a very secure members only area. Any tips on the best addon's to use to achieve this? Would having an SSL on the server also be a good idea? We are not storing things like credit card data, but will be storing some sensitive info like member names, addresses, phone no's and email addresses and its imperative we have this all behind a very secure members area. This information will only be available to logged in members - so the public site will have a MEMBERS button which will then prompt them to login - members become members ONLY by invitation. I need a system / addon / set of addon's which I could use to build this out in Revo I hope...

Any insight anyone can share who has done similar?


Cheers

dubbs.

http://rtfm.modx.com/extras/revo/login

http://rtfm.modx.com/revolution/2.x/administering-your-site/security
http://rtfm.modx.com/revolution/2.x/administering-your-site/security/security-tutorials/making-member-only-pages

You might also look at the Subscribe extra, which will manage registration and user preferences for you. Notify is often used with it to communicate with members.

http://bobsguides.com/subscribe-tutorial.html

http://bobsguides.com/notify-tutorial.html

SSL is always good, though the MODX DB is fairly secure to begin with.

BTW, Subscribe, unlike some other options, does a good job of protecting the user information during the registration process. It's designed as a double-opt-in System though, so I'm not sure what you'd need to do to use it with an invitation-only setup.

Susan / Bob - thanks for the links... I will take a look // many thanks

Susan - Without SSL - how secures is Login addon with Revo?

You can use SSL on the login pages if you want to.

http://modx.com/extras/package/revossl
http://rtfm.modx.com/revolution/2.x/administering-your-site/security/hardening-modx-revolution#HardeningMODXRevolution-AddinganSSLCertificatetoyourManager
https://forums.modx.com/thread/14025/how-to-make-a-single-page-in-modx-ssl-secure

Quote from: BobRay at Jun 29, 2014, 10:16 PM

You might also look at the Subscribe extra, which will manage registration and user preferences for you. Notify is often used with it to communicate with members.

http://bobsguides.com/subscribe-tutorial.html

http://bobsguides.com/notify-tutorial.html

SSL is always good, though the MODX DB is fairly secure to begin with.

BTW, Subscribe, unlike some other options, does a good job of protecting the user information during the registration process. It's designed as a double-opt-in System though, so I'm not sure what you'd need to do to use it with an invitation-only setup.

Bob - would you say Subscribe is better then in terms of security than Login addon?

Quote from: sottwell at Jun 30, 2014, 06:07 AM

You can use SSL on the login pages if you want to.

http://modx.com/extras/package/revossl
http://rtfm.modx.com/revolution/2.x/administering-your-site/security/hardening-modx-revolution#HardeningMODXRevolution-AddinganSSLCertificatetoyourManager
https://forums.modx.com/thread/14025/how-to-make-a-single-page-in-modx-ssl-secure

Thanks Susan.

Bob - I am not sure Subscribe would work as I need it - the members for the site are only issued by a CMS user - I don't need a system for end users to request to become a member - we, infact want the opposite! - with the only way to become a member should be if the CMS user creates you as a member in the Manager. I think therefore login would be the better option perhaps? Login mixed with the member only resources as per the core manager functionality as mentioned here > https://forums.modx.com/thread/91830/revo-secure-members-area-on-new-site#dis-post-501749 should work best I think?

I agree, though it might still be worth using Subscribe/Notify to manage user preferences and communicate with users once they've joined.

You could also issue "invitations" the were just links to a page with the subscribe registration form on it. You could add a verification code in the link (Subscribe has a method to generate one) so it would be a protected page.

Users would have to click on the link in the following email to confirm their registration, but that's not necessarily a bad thing since it verifies their email address.