André Warnier wrote:
Jeff Sherk Forerunner Ministries wrote:When requiring a username & password with AuthType Basic, is it possible to include them in a POST or GET request to the server so that it won't ask for them (because they were provided)?If it's possible, what variable names are assigned to them.Jeff,I believe you have a bit more studying to do in terms of HTTP authentication scriptures.I recommend to you the following on-line documents, in that order : a) http://en.wikipedia.org/wiki/Basic_access_authentication b) http://httpd.apache.org/docs/2.2/howto/auth.html c) http://tools.ietf.org/html/rfc1945#section-11.1The truth is in there. Unfortunately, these documents can be a bit hermetic to the non-initiated, so here is a short introduction :On a webserver, you usually define different areas containing documents, and corresponding URLs to access them. In Apache, these areas and URLs correspond more or less to configuration sections such as <Directory> and <Location>. (You can also use a .htaccess file inside of the directory itself, but that is frowned upon if you have access to the main webserver configuration).If you want to protect access to such a Directory or Location, you can specify rules, as described in (b) above.For the "basic" type of authentication, ("AuthType Basic"), the parameter : "AuthName xxxxxxxxxxxx" is also very important.You can have different server areas which are covered by the same "AuthName". This is like in a building, you could have different rooms marked "Prophets Only", while other rooms are marked "Mere Converts OK". As soon as one has authenticated for one of the "Prophets Only" areas, he is allowed to access any other room marked "Prophets Only", without needing to supply his credentials again.The way it works, is that a browser "remembers" that it has already accessed one of the "Prophets Only" areas previously within the same browser session. So when he accesses a new area, when the server responds that for this one, one needs a "Prophets Only" authentication, the browser just looks in its cache to see if it already has one of those, and if yes, it re-issues the same request again, without user intervention, but this time with the appropriate request header providing his "Prophets Only" authentication credentials.This all happens automatically, without the user even noticing.It is only the first time that the browser accesses a "Prophets Only" area, that it does not find this in its cache, and has to ask the user to provide a user-id and password.So, to get back to your original question above :- you do not need to do anything special to get this behaviour, other than making sure that the different areas of your server which you want to be covered by the /same/ credentials, use the /same/ "AuthName" value. - there are no "variables" assigned to this. It happens via HTTP headers which the browser automatically adds to the request, when applicable.(*)Now I suggest that you re-read document (b) above once more, hoping that with this short overview it will now be more accessible.(*) This is not entirely true. It is generally the case, when a request has been "authenticated" by Apache, that a script running under Apache can access the authenticated user-id assigned to this request. To see how however, you will have to consult yet more documentation, depending on the programming language these scripts are written in.---------------------------------------------------------------------The official User-To-User support forum of the Apache HTTP Server Project.See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
--------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|