RE: retrieving user/password from auth
Axel Amthor (axel.amthor@interprise.de)
Sun, 13 Sep 1998 13:58:19 +0200
Hi,
The problem in #2 is, how browsers handle basic authentication.
i.e., the server normally *always* sends an "unauthorized" Code (401) back
to the client
when the client tries to access a restricted file. The browser then sends
back
the former stored userid/password pair he once asked for. There is no way,
to
force the browser to drop this stored userid/password pair for the entire
site
by sending an http-response. To log off from a site with basic
authentication needs
the user to terminate the complete browser session and to start over. This
is maximum
uncomfortable.
For this, i usually do a cookie based authentication. And this is the
solution for
Problem #1 as well. As you have to evaluate userid/passwort in your cgi and
give a "secret"
(the cookie), you can store this in any temporary place. You then have
several possibilities
for
* automtaically expire the cookie (cookie lifetime): The user has to
re-identify after x hours/minutes
* Force the cookie to come invalid: Log off by the user
etc.
This really is more comfortable, as you can provide a html Form for Login
and Logoff. There are
several basic routines available on the net, you do not have to code this on
your own.
hope this helps...
> -----Original Message-----
> From: libwww-perl-request@ics.uci.edu
> [mailto:libwww-perl-request@ics.uci.edu]On Behalf Of Peter F. Brown
> Sent: Samstag, 12. September 1998 19:05
> To: libwww-perl@ics.uci.edu
> Subject: retrieving user/password from auth
>
>
> Dear Folks,
>
> Although I've been using Perl now for almost two years,
> and am doing pretty well, I am completely stumped about the
> www-authentication routines. I need to do two things with a Perl
> script accessed via the web:
>
> 1. Retrieve the username / password pair after the user has
> gone through the .htaccess authorization process
>
> 2. Log out the user by resetting the authorization so the browser
> no longer contains the "authorized" code, and reprompts the user
> to enter the authorization
>
> I've tried doing #2 with an nph-script like this, but it didn't work:
> (the script contained only these two lines, and was named
> "nph-logoff.cgi")
>
> print "HTTP/1.0 401 Unauthorized -- authentication failed\r\n";
> print "WWW-Authenticate: Basic realm="Test Authentication";
>
> I tried #1, with code like this, but I think that my lack of clarity
> about objects, etc, has waylaid me:
>
> use LWP::UserAgent;
> use HTTP::Headers;
> $h = new HTTP::Headers;
> print $h->as_string;
> %auth = $h->authorization_basic;
> foreach $i (sort keys %auth)
> {
> print "$i is $auth{$i}<br>";
> }
>
> I've scoured the docs in the LWP distribution, but I'm really stuck.
> Could anyone give me a clue?
Axel Amthor Interprise Network Computing GmbH
Witneystr. 1, 82008 Unterhaching
mailto:axel.amthor@interprise.de
http://www.interprise.de
Fone: +49 (0) 89 / 61 55 95 - 30
Fax: +49 (0) 89 / 61 55 95 - 29