Authentication?

[teho]

Hello,

Is this kind of code much used for authentication?
...
if (!isset($_SERVE R["PHP_AUTH_U SER"])) {
header('WWW-Authenticate: Basic realm="Log in"');
header("HTTP/1.0 401 Unauthorized");
....

I have tried to play with it and downloaded a lot of codeexamples. I find
it hard
to control when I am logged in and when I am logged out. I can log out and
it seems
like it also, but when I do a refresh on my page am am logged in again.

Maybe I have missed something and that is why I dont get it to work
properly.


But would it be better to create my own form for logging in and have more
control? I guess
I would have control doing that.


- Terje



--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

[Jan Pieter Kunst]

Re: Authentication?

In article <opr671cny5ct3i n9@news.Individ ual.net>,
teho <teho0001@broad park.no> wrote:
[color=blue]
> Hello,
>
> Is this kind of code much used for authentication?
> ...
> if (!isset($_SERVE R["PHP_AUTH_U SER"])) {
> header('WWW-Authenticate: Basic realm="Log in"');
> header("HTTP/1.0 401 Unauthorized");
> ....
>
> I have tried to play with it and downloaded a lot of codeexamples. I find
> it hard
> to control when I am logged in and when I am logged out. I can log out and
> it seems
> like it also, but when I do a refresh on my page am am logged in again.
>
> Maybe I have missed something and that is why I dont get it to work
> properly.[/color]

The problem with $_SERVER['PHP_AUTH_USER'] is that once it is set, it's
not possible to unset it, except by quitting the browser. I use it for
simple access control, only when logging out of the application is not
needed. If you need logging out, it's a better idea to create your own
session variables for managing authentication.

JP

--
Sorry, <devnull@cauce. org> is een "spam trap".
E-mail adres is <jpk"at"akamail .com>, waarbij "at" = @.

[teho]

Re: Authentication?

On Thu, 29 Apr 2004 16:46:43 +0200, Jan Pieter Kunst <devnull@cauce. org>
wrote:
[color=blue]
> In article <opr671cny5ct3i n9@news.Individ ual.net>,
> teho <teho0001@broad park.no> wrote:
>[color=green]
>> Hello,
>>
>> Is this kind of code much used for authentication?
>> ...
>> if (!isset($_SERVE R["PHP_AUTH_U SER"])) {
>> header('WWW-Authenticate: Basic realm="Log in"');
>> header("HTTP/1.0 401 Unauthorized");
>> ....
>>
>> I have tried to play with it and downloaded a lot of codeexamples. I
>> find
>> it hard
>> to control when I am logged in and when I am logged out. I can log out
>> and
>> it seems
>> like it also, but when I do a refresh on my page am am logged in again.
>>
>> Maybe I have missed something and that is why I dont get it to work
>> properly.[/color]
>
> The problem with $_SERVER['PHP_AUTH_USER'] is that once it is set, it's
> not possible to unset it, except by quitting the browser. I use it for
> simple access control, only when logging out of the application is not
> needed. If you need logging out, it's a better idea to create your own
> session variables for managing authentication.
>
> JP
>[/color]

Thanks!

What you say here corresponds to what I am struggeling with, trying
to unset PHP_AUTH_USER.

Fine, I will write my own login then.

--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

[jsWalter]

Re: Authentication?


"teho" <teho0001@broad park.no> wrote in message
news:opr68jiic4 ct3in9@news.Ind ividual.net...
[color=blue]
> Thanks!
>
> What you say here corresponds to what I am struggeling with, trying
> to unset PHP_AUTH_USER.
>
> Fine, I will write my own login then.[/color]

Well, you could use PEAR:Auth and/or PEAR:LiveUser instead of rolling your
own.

Just a thought

Walter

http://web.torres.ws