473,386 Members | 1,804 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,386 software developers and data experts.

WWW-Authenticate: How to force password login at every page refresh ?

<!--
The following sample should authorize the user to log on the site.
This works once but after refreshing the browser, it does not prompt
again for login until all browser (IE 6) windows are closed and the
same page is opened.
I turned off all caching but still it does cache (as a refresh doen
not promt again).

How can I force the page to prompt for a password at every refresh ?

Thanks, Klaas

-->
<html>
<head>
<META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<?php

$showall = false;
error_reporting (E_ERROR);

if (($PHP_AUTH_USER != "myname") || ($PHP_AUTH_PW != "mypass"))
{
header('WWW-Authenticate: Basic realm="Secure Login"');
header('HTTP/1.0 401 Unauthorized');
$showall = false;
}
else
{
error_reporting (E_ALL ^ E_NOTICE);
$showall = true;
}

if (!showall) {
echo "access denied";
} else {
?>

................

</head>
<body>

.................

<? } ?>

</body>
</html>
Jul 17 '05 #1
2 5429
thenetflyer wrote:
The following sample should authorize the user to log on the site.
This works once but after refreshing the browser, it does not prompt
again for login until all browser (IE 6) windows are closed and the
same page is opened.
I turned off all caching but still it does cache (as a refresh doen
not promt again).

How can I force the page to prompt for a password at every refresh ?


You can't. Browsers are designed to work like this so people don't need to
keep entering their login name and password. Why are *you* wanting to do
this? Do you really want them to have to enter their login name and
password *every time* they request a page in your secure area?

What you could do to make this work (if it's really that important to you :)
is use this in combination with a cookie. Set the cookie when they first
access the page successfully. If the cookie is set as well as the login and
password then you know this is the second request, so you just deny access
again using the 401 header (and clear the cookie at the same time). This is
far from foolproof but it is some sort of solution. Note that you need to
set the cookies BEFORE you output any HTML, so you need to move all your
authentication logic to the top of the script.

Another (more foolproof) solution, would be to track their accesses in a
database or log file. If the second successfull request is within x seconds
of the last one you could then send a second 401 header requesting they
authenticate again. But this could cause more problems for your customers.

Sending a 2nd 401 header worked for me using Konqueror (ie it asked for the
login and password again), whether or not it will work in all browsers I
don't know.

--
Chris Hope
The Electric Toolbox - http://www.electrictoolbox.com/
Jul 17 '05 #2
I have been pounding my head on the same wall for 3 days now.

I have discovered that this is "normal" behavour.

You cn not force a "logout" of a www-authentication session without the
browser closing first.

Period. End of story.

(PLEASE! Someone tell me I'm wrong!)

I have a working model using PEAR::Auth, and my new extension to Auth,
AuthUser.

Right now it tracks logins, limits attempts to a defined limit (well, as far
aas this kind of thing can), fixes the DB case-insensitive ID location (some
DBs do a look up case insensitive, do JoE and jOe are the same).

I will have group, access, and level added soon.

Anyway. I have code that con do what you ask, but it uses an HTML login
form. :/

I'm still waiting for someone to prove me wrong with real code.

If you'd like a copy of my example code, drop me a note and I'll send it to
you.

Walter
Jul 17 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

18
by: shank | last post by:
I'm trying to qualify email addresses. Is there any reason why the following line would not catch an email address beginning with "www." ? ElseIf Left(Session("em"),4) = "www." Then I put in a...
4
by: hooterbite | last post by:
string: www.google.com "\\swww\\S*" returns " www.google.com' string: http://www.google.com "\\dwww\\d\\S*" matches, seems like it doesn't mind the http:// before the www. I want to match...
0
by: hooterbite | last post by:
I need to loop through paragraphs of text and "activate" the links, which could either have the http:// or just start with www. I have no problem finding the ones that start with http://. The...
0
by: Medieval Tours | last post by:
<br> <div align="center"><a href="http://www.medievaltours.ro/en/about.php"><span style=""></span></a><a href="http://www.medievaltours.ro/en/about.php"><span style=""><img...
13
by: Steve | last post by:
Hi; A friend of mine is publishing a book that includes 3000 citations, many with urls. When he made his bibliography he chopped off the "http://"s off of his urls. I wrote a program to...
0
by: www.northvacancies.com | last post by:
Hi Friends Have a great day!! We would like to forward the exciting job opportunities from the below TOP companies.. Q3 Technologies Recruits Java UI (Swing) Developer...
0
by: taylorcarr | last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
0
by: Charles Arthur | last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
by: emmanuelkatto | last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...
0
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
0
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.