I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate through a database.

For example: A user tries to use this "locked" website and therefore needs to authenticate. The website creates e.g a file on the computer that the desktop application can read. If the application can read the file it shall respond to the website that everything is ok.

Are there any good ways to verify that the user is located on the correct computer?

  • 2
    Good question, but try to add a little bit more information to make it a bit easier for people to awnser (i.e.: what kind of system is it, i know you used the PHP tag, but state so in your question, also try to add what kind of database and such, naming names helps!).
    – Lighty
    Commented Oct 15, 2014 at 9:00

4 Answers 4


One relatively easy approach to this would be to create a persistent cookie on the client's side after the first log in. The cookie should hold only the user's username and a generated key. During the next log in the server would verify the key against the same key stored in the database and if it doesn't match or the user doesn't have the cookie at all you can react in a way you want, for example some type of second level authentication etc..

This however brings up the question, what to do if the user for example clears cache or changes the browser? This should be something you take into account. Probably one of the most well known application which uses this system of authentication and verification on new computers is Steam. No cookies, but the principle is basically the same.


As PiTheNumber said you can't just create or safe a file on the users drive.

But you could let the user download your generated file so the user can open it with your desktop application after he finished downloading it.

This is no problem with php, just send the right headers and almost every Browser will start the download.

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"'); //<<< Note the " " surrounding the file name
header('Content-Transfer-Encoding: binary');
header('Connection: Keep-Alive');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($file));

See this SO-Question for more information.

Another aproach would be to modify your desktop application so that it sends a request to the server (With some information, public IP, operating system, installed browsers etc.) so the user can login on the website after the application was installed.

A third possible solution would be a browser extention written for authentification, so your website might be allowed to communicate directly (or over a file) with your desktop application.


Because of security restrictions you can not create a file on the client side. Using JavaScript you can however store data in Cookies or localStorage. See https://stackoverflow.com/questions/3950131/how-can-i-create-a-file-on-client-side-by-javascript

You might be able to read this data from your Desktop App. See https://stackoverflow.com/questions/3801675/where-cookies-are-stored-in-system and https://stackoverflow.com/questions/8634058/where-the-sessionstorage-and-localstorage-stored


On second thought, you wrote:

I've got a web based system where a specific site only shall be available on a certain computer.

I would make a normal user login an attach an option for this user that he can display this page. No need to create a file or communicate with the desktop app.

  • That won´t stop him from login on another computer?
    – hgerdin
    Commented Oct 15, 2014 at 12:06
  • No, but it would stop anyone else to access this page. Now you only need to tell the account owner not use this account from anywhere else. You could also check client IP during login. Commented Oct 15, 2014 at 12:13

Most client-side solutions such as cookies and client certificates are not strictly machine-bound and can be exported to another device or circumvented if a user really wants to.

One simple solution would be to loop a Kensington lock cable though the eye of a one-time-password dongle connected to the computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .