A software modernization project by Guy Simonian to provide an alternative method of accessing the Check Fund Manager web portal while preserving its existing business applications.
Some clients operate behind corporate network policies that restrict the use of HTTP Basic Authentication for vendor accounts. The project provides an alternative login interface for these clients while retaining the existing authentication option for other users.
I undertook the design, implementation, and testing of the alternative authentication interface and its integration with existing Perl and PHP applications. The work includes login processing, session validation, access controls, and diagnostic logging.
The session-cookie configuration uses HttpOnly, Secure, and SameSite=Lax attributes as complementary safeguards. HttpOnly prevents browser JavaScript from reading the session cookie, reducing the risk of session-identifier theft through cross-site scripting (XSS). Secure restricts transmission of the cookie to HTTPS connections. SameSite=Lax limits when the browser includes the cookie in requests originating from other sites, helping reduce exposure to cross-site request forgery (CSRF) while allowing ordinary navigation to the portal. These safeguards supplement server-side session validation and application-level access controls.
A central challenge is maintaining consistent authenticated access across an established application environment. Login processing, browser cookies, server-side session records, and subsequent validation requests must all identify the same session.
Testing also identified an intermittent condition in which a server-side session record existed, but the session checker reported that the expected browser cookie was absent. Investigation focuses on distinguishing session creation from cookie delivery and receipt.
A technical challenge was enabling existing Perl applications and PHP components to work with a consistent representation of authenticated session data. I developed a Perl-based, JSON-compatible bridge to convert Perl-readable session data associated with the browser's session cookie into a format that PHP could interpret. This allowed the applications to exchange the information needed for session validation without requiring a complete rewrite of the existing Perl session-management code.
Behind the scenes, the project includes staff-facing administration tools that support account configuration and session management. A username-to-client-ID mapping tool associates login usernames with the appropriate Check Fund Manager client identifiers. A session management registry records session information to support staff oversight, troubleshooting, and investigation of authentication issues.
The alternative login workflow has been implemented and remains under testing and refinement. It provides an additional access option for clients whose network policies restrict Basic Authentication. Ongoing work includes investigating intermittent cookie-related validation failures and improving diagnostic visibility.
I used Visual Studio Code for source-code editing and development, and Perplexity, an AI assistant from Perplexity AI, to support technical research, explore implementation approaches, troubleshoot issues, and draft project documentation. I retained responsibility for implementation, testing, and deployment decisions.
The project encompassed approximately 10,000 lines of new or modified Perl and PHP code across 50 routines. Its scope included authentication, session validation, a JSON-compatible Perl to PHP integration bridge, and staff administration tools for username-to-client-ID mapping and session management registry.
This project illustrates the practical work of extending an established business application: accommodating client network requirements, integrating new authentication workflows, and investigating problems that span browser behavior and server-side processing.