Authentication?

[teho]

Hello,

Is this kind of code much used for authentication?
...
if (!isset($_SERVER["PHP_AUTH_USER"])) {
header('WWW-Authenticate: Basic realm="Log in"');
header("HTTP/1.0 401 Unauthorized");
....

I have tried to play with it and downloaded a lot of codeexamples. I find
it hard
to control when I am logged in and when I am logged out. I can log out and
it seems
like it also, but when I do a refresh on my page am am logged in again.

Maybe I have missed something and that is why I dont get it to work
properly.
But would it be better to create my own form for logging in and have more
control? I guess
I would have control doing that.
- Terje

--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

[Jan Pieter Kunst]

In article <op**************@news.Individual.net>,
teho <te******@broadpark.no> wrote:

Hello,

Is this kind of code much used for authentication?
...
if (!isset($_SERVER["PHP_AUTH_USER"])) {
header('WWW-Authenticate: Basic realm="Log in"');
header("HTTP/1.0 401 Unauthorized");
....

I have tried to play with it and downloaded a lot of codeexamples. I find
it hard
to control when I am logged in and when I am logged out. I can log out and
it seems
like it also, but when I do a refresh on my page am am logged in again.

Maybe I have missed something and that is why I dont get it to work
properly.

The problem with $_SERVER['PHP_AUTH_USER'] is that once it is set, it's
not possible to unset it, except by quitting the browser. I use it for
simple access control, only when logging out of the application is not
needed. If you need logging out, it's a better idea to create your own
session variables for managing authentication.

JP

--
Sorry, <de*****@cauce.org> is een "spam trap".
E-mail adres is <jpk"at"akamail.com>, waarbij "at" = @.

[teho]

On Thu, 29 Apr 2004 16:46:43 +0200, Jan Pieter Kunst <de*****@cauce.org>
wrote:

In article <op**************@news.Individual.net>,
teho <te******@broadpark.no> wrote:

Hello,

Is this kind of code much used for authentication?
...
if (!isset($_SERVER["PHP_AUTH_USER"])) {
header('WWW-Authenticate: Basic realm="Log in"');
header("HTTP/1.0 401 Unauthorized");
....

I have tried to play with it and downloaded a lot of codeexamples. I
find
it hard
to control when I am logged in and when I am logged out. I can log out
and
it seems
like it also, but when I do a refresh on my page am am logged in again.

Maybe I have missed something and that is why I dont get it to work
properly.

The problem with $_SERVER['PHP_AUTH_USER'] is that once it is set, it's
not possible to unset it, except by quitting the browser. I use it for
simple access control, only when logging out of the application is not
needed. If you need logging out, it's a better idea to create your own
session variables for managing authentication.

JP

Thanks!

What you say here corresponds to what I am struggeling with, trying
to unset PHP_AUTH_USER.

Fine, I will write my own login then.

--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

[jsWalter]

"teho" <te******@broadpark.no> wrote in message
news:op**************@news.Individual.net...

Thanks!

What you say here corresponds to what I am struggeling with, trying
to unset PHP_AUTH_USER.

Fine, I will write my own login then.

Well, you could use PEAR:Auth and/or PEAR:LiveUser instead of rolling your
own.

Just a thought

Walter
http://web.torres.ws