Cabinets · custom authentication
A client cabinet built on top of Bitrix24
Client:
sattar.kz
Category: Cabinets
Stack: Bitrix24 D7, HL blocks, PHP, CSRF/rate-limiting, secure file delivery
Timeline: 4–6 weeks
sattar.kz
Category: Cabinets
Stack: Bitrix24 D7, HL blocks, PHP, CSRF/rate-limiting, secure file delivery
Timeline: 4–6 weeks
Problem
At sattar.kz, clients could not check the status of their cases and documents themselves — everything went through calls and messages to a manager, and giving clients access to the CRM itself was not an option.
Constraints
Clients could not be set up as Bitrix24 user accounts (licensing and access risk), so authentication had to be built from scratch, alongside secure document delivery and role-based visibility of case fields.
What I did
- Separate client authentication with no Bitrix user accounts — built on HL blocks, with hashed sessions and brute-force protection
- CSRF protection and rate-limiting on the login form
- Viewing cases, documents and invoices with role-based field visibility — a client sees only what they are meant to
- Secure file delivery with no direct links to storage
- Groundwork for client chat via Bitrix Open Lines
Screenshots
Screenshot coming soon
Client login form for the cabinet
Screenshot coming soon
List of client cases with statuses
Screenshot coming soon
Viewing a document via secure file delivery
Architecture
Client
→ Cabinet (custom auth)
→ Session HL blocks
→ Portal CRM data (role-based access)
→ File storage
Result
Clients got self-service without direct CRM access: case status, documents and invoices — in a separate cabinet with its own protected authentication.
What can be reused
Custom HL-block authentication with no Bitrix user accounts
Role-based visibility of CRM fields
Secure file delivery
Cabinet skeleton on top of on-premise Bitrix24