Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7800

Re: Digest Authentication

Show all headers | View raw

On 12/13/2012 7:49 PM, dhtmlkitchen@gmail.com wrote:
> Hi,
>
> I am trying to implement a password protected area of a site. I have never done this before.
>
> HTTP digest authentication seemed suitable for our low-level security requirements.
>
> Here is our PHP 5.3.6 configuration:
> http://thai-massage.com/phpinfo.php
>
> Here is the script I am using, from PHP.net:
> http://php.net/manual/en/features.http-auth.php#example-349
>
> The script is running here:
> http://thai-massage.com/dollar-school/PHP-PayPal-IPN-master/example/auth.php
>
> The login credentials are hard coded for sake of example. Eventually I want to get the password from a MySQL database.
>
> Results:
>   * Cancel:  "Text to send if user hits Cancel button"
>   * Correct Login (guest/guest): Displays login prompt again
>   * Incorrect Login (a/s): Displays login prompt again
>
> Expected results:
>   * Cancel:  "Text to send if user hits Cancel button"
>   * Correct login (guest/guest): 'You are logged in as: guest"
>   * Incorrect login: "Wrong Credentials!"
>
> Cancel is doing what I expect, but the login does not.
>
> What am I doing wrong? How can I get the result I want?
>

One other point - this is NOT a very good script.  For instance, you 
should NEVER use die() on a production system, especially for a 
non-critical error.  die() terminates processing of the page 
immediately, resulting in invalid HTML at the browser.

Additionally, I think a very low percentage of PHP sites use such 
authentication.  Most have their own login page (using https protocol). 
  Once the user logs in, the script sets the appropriate information in 
the $_SESSION array.  Pages which require login just check for the 
necessary data in the $_SESSION array, and if incorrect, redirect the 
user to the login page.  If the data are correct, the script just 
continues with what it's supposed to do.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Digest Authentication dhtmlkitchen@gmail.com - 2012-12-13 16:49 -0800
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:15 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:31 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 23:15 -0500
    Re: Digest Authentication xkit <dhtmlkitchen@gmail.com> - 2012-12-18 17:55 -0800
      Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-18 21:08 -0500
        Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 09:40 -0800
          Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-19 15:02 -0500
            Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 20:59 -0800
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:02 -0500
          Re: Digest Authentication "Peter H. Coffin" <hellsop@ninehells.com> - 2012-12-19 14:30 -0600
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-19 17:26 -0500
          Re: Digest Authentication Scott Johnson <noonehome@chalupasworld.com> - 2012-12-19 17:02 -0800
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-20 20:17 -0500
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 23:10 -0500
              Re: Digest Authentication The Natural Philosopher <tnp@invalid.invalid> - 2012-12-21 10:19 +0000
          Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-20 09:57 +0100
            Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:06 -0500
    Re: Digest Authentication legalize+jeeves@mail.xmission.com (Richard) - 2012-12-22 19:15 +0000
  Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-14 12:05 +0100

csiph-web