Re: Anybody used htaccess in a form?
- From: Owen Rees <orees@xxxxxxxxxxx>
- Date: Mon, 01 Sep 2008 00:23:06 +0100
On Sun, 31 Aug 2008 16:11:10 +0100, "dE|_"
<spambusters@xxxxxxxxxxxxxxxxxxxx> wrote in
<swyuk.56786$OR5.20207@xxxxxxxxxxxxx>:
I had tried a very simple page encryption software that uses javascript to
scramble up the entire page's HTML until login. This is something I can do
entirely on my own but is obviously risky for accessibility.
Htaccess is one I tried, and works with no accessibility or cross-browser
issues, but is not pretty and the entry box does not sit in the page. That's
where we are now. It can sit in a form, but you need a script like php to
send the form details to the htaccess controller.
Question answered, and you have suggested the php fetch.
If all you want to protect is a single HTTP resource then the answers
you have been given may be sufficient, but in my experience this
situation is rare.
It is much more common to want to create an authenticated session so
that the user can retrieve a number of protected HTML, CSS, image and
perhaps other resources after a single login rather than having to
repeat the login for each individual resource.
Browsers generally have a built in way to respond to the authentication
requests defined in the HTTP protocol and will issue the necessary
headers without user intervention after the initial dialogue where the
user gives the username and password to the browser. Note here the
important point that the browser needs to be given that information if
it is to include it in the HTTP protocol exchanges for subsequent
resource retrievals. None of the suggestions for server-side processing
of form data have included any information about how the browser obtains
the user credentials. I am not aware of any way in which a server side
mechanism can add a username and password to the set from which the
browser selects the appropriate pair when creating the 'Authorization'
header in an HTTP request.
It is these HTTP protocol authentication mechanisms that people often
inaccurately refer to as 'htaccess' (see the Apache httpd documentation
if you want an explanation of why I say 'inaccurately'.)
Note here that the choice of server side language is irrelevant. If
anyone can say what protocol exchange between browser and server can
download credentials for basic or digest authentication from server to
browser then the server side part can be coded in whatever language you
like.
--
Owen Rees
[one of] my preferred email address[es] and more stuff can be
found at <http://www.users.waitrose.com/~owenrees/index.html>
.
- References:
- Re: Anybody used htaccess in a form?
- From: dE|_
- Re: Anybody used htaccess in a form?
- Prev by Date: Re: IE v8 beta 2
- Next by Date: Re: I see what you hated about IE6
- Previous by thread: Re: Anybody used htaccess in a form?
- Next by thread: Re: Anybody used htaccess in a form?
- Index(es):
Relevant Pages
|
