In version 11, ShopSite began offering a new login mechanism.  In all previous versions of ShopSite, the login mechanism was provided by the web server. Using the web server had several advantages.  First, ShopSite did not need to develop a new login procedure since all web servers provided a login mechanism.  Second, because web server login is well known to web masters, if a merchant forgot their password, the server admin could easily create a new password for them.  And finally, sophisticated hosts could modify the web server login to integrate with logins for other systems thereby giving users a single login (or single sign-on) for ShopSite, their hosting account, and other services.

So why change ShopSite Login?  One reason is that the PCI Security Standards Council requires a more sophisticated login than most web servers support.  Some of the functionality required to pass an audit include:

• Require a minimum password length of at least seven characters.
• Use passwords containing both numeric and alphabetic characters.
• Do not allow an individual to submit a new password that is the same as any of the last four passwords he or she has used.
• Limit repeated access attempts by locking out the user ID after not more than six attempts.
• Set the lockout duration to a minimum of 30 minutes or until administrator enables the user ID.
• If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.
• Change user passwords at least every 90 days

Since the web server is enforcing the merchant login, there was no easy way for ShopSite to enforce any of the above requirements.

Certainly, the above requirements make the new ShopSite Login more secure.  Additionally, while creating the new ShopSite Login (the new User Accounts feature), we added functionality.  For example, you now have an “I forgot my password” link on the login page.  Previously, if you forgot your password you would need to contact your host and have them reset it.  Now you can click the link and receive an e-mail with a link to reset your password.  Once you answer a challenge/validation question, you can reset your password yourself.

Another benefit with the new ShopSite Login is that a store can have multiple, unique, user logins.  Prior to User Accounts, if you had several employees that needed access to ShopSite, they would all share the same login id and password. With multiple user accounts, it is easier to track when any particular user has logged in and accessed orders.

With ShopSite Pro stores, we’ve further refined the individual user accounts with the concept of roles.  With the roles feature, you can restrict what a particular user can have access to.  The specific roles that you can assign are:

• Administrator – access to all features
• Order Processing – access to orders including payment details
• Order Fulfillment – access to orders but not to payment details
• Content Management – access to creating/modifying pages, products, etc.
• Reports – access to reports.

You can assign one or more roles to each user.

As you can see, the new ShopSite Login can be very useful.  While we recommend using the new ShopSite Login, for the merchants or hosts that are comfortable with login the way it has been, ShopSite still supports web server login.  When you are ready to make the switch, just go to Utilities -> User Accounts and follow the setup wizard.  If your store is not sharing ShopSite program files (e.g. CGIs), at the end of the wizard you will be prompted to remove the web server login (which you should do.)  If you enable User Accounts, but do not remove web server login, you will be prompted to login twice – first by the web server, and then by ShopSite.  If your store is sharing the program files with other stores (e.g. in a mall setup), you will not be prompted to disable the web server login, since doing so would affect all merchants in the mall.

One final note, whether you are using web server login or ShopSite Login, if your store supports SSL (e.g. https://), ShopSite will use this more secure method throughout the back office (merchant interface), and not just when viewing orders or sensitive configuration information.