Re: Digest Authentication

Path	csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!storethat.news.telefonica.de!telefonica.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!not-for-mail
From	"M. Strobel" <sorry_no_mail_here@nowhere.dee>
Newsgroups	comp.lang.php
Subject	Re: Digest Authentication
Date	Fri, 14 Dec 2012 12:05:41 +0100
Lines	29
Message-ID	<aj0fg5FjfihU1@mid.uni-berlin.de> (permalink)
References	<33f0a5af-2fa2-4ea3-93ca-95ebb65320e8@googlegroups.com>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	7bit
X-Trace	news.uni-berlin.de qAMEBElt0bDZADvUjCuXcAIiFG8bmCQnpRfykk5x5gGY+HKAAow9wP+HYzFc11h18=
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20121025 Thunderbird/16.0.2
In-Reply-To	<33f0a5af-2fa2-4ea3-93ca-95ebb65320e8@googlegroups.com>
Xref	csiph.com comp.lang.php:7801

Show key headers only | View raw

Am 14.12.2012 01:49, schrieb dhtmlkitchen@gmail.com:
> Hi,
> 
> I am trying to implement a password protected area of a site. I have never done this before.
> 
> HTTP digest authentication seemed suitable for our low-level security requirements.
> 
> Here is our PHP 5.3.6 configuration:
> http://thai-massage.com/phpinfo.php
> 
> Here is the script I am using, from PHP.net:
> http://php.net/manual/en/features.http-auth.php#example-349
> 
> The script is running here:
> http://thai-massage.com/dollar-school/PHP-PayPal-IPN-master/example/auth.php
> 
> The login credentials are hard coded for sake of example. Eventually I want to get the password from a MySQL database.

General answer:

I would never code basic auth or digest auth in PHP. This is a feature that is
offered completely functional by the web server. I would use it to lock up test
systems, or for the "quick and dirty" protection of some areas, used by few people
(only me).

The regular case is a real PHP login, using a database for user credentials, and
session variables to store the login status.

/Str.

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Digest Authentication dhtmlkitchen@gmail.com - 2012-12-13 16:49 -0800
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:15 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:31 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 23:15 -0500
    Re: Digest Authentication xkit <dhtmlkitchen@gmail.com> - 2012-12-18 17:55 -0800
      Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-18 21:08 -0500
        Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 09:40 -0800
          Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-19 15:02 -0500
            Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 20:59 -0800
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:02 -0500
          Re: Digest Authentication "Peter H. Coffin" <hellsop@ninehells.com> - 2012-12-19 14:30 -0600
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-19 17:26 -0500
          Re: Digest Authentication Scott Johnson <noonehome@chalupasworld.com> - 2012-12-19 17:02 -0800
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-20 20:17 -0500
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 23:10 -0500
              Re: Digest Authentication The Natural Philosopher <tnp@invalid.invalid> - 2012-12-21 10:19 +0000
          Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-20 09:57 +0100
            Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:06 -0500
    Re: Digest Authentication legalize+jeeves@mail.xmission.com (Richard) - 2012-12-22 19:15 +0000
  Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-14 12:05 +0100

csiph-web