Gossamer Forum
(Advanced Search)
for
Home : General : Perl Programming :

use form to post username and password to .htaccess

Jan 17, 2003, 3:16 PM
cK
Enthusiast (567 posts)
Jan 17, 2003, 3:16 PM
Post #1 of 5
Views: 5208
Shortcut
Quote Reply
use form to post username and password to .htaccess
Hi,

I'm wondering what the security implications are of using a form to post the username and password to .htaccess. Something like: http://loginname:password@www.domain.com/password_protected_dir/

> Browsers history files, referer information and so...

----
I want to avoid the pop-up-box, so I want to check the username and password with a script, then post the username and password to a htaccess protected dir. Just because then I'm able to use $ENV{'REMOTE_USER'} to offer custom pages to logged in users. Sound smart or stupid?

Last edited by:

cK: Jan 17, 2003, 4:06 PM
Jan 17, 2003, 3:54 PM
wysardry
User (228 posts)
wysardry's avatar
Jan 17, 2003, 3:54 PM
Post #2 of 5
Views: 5058
Shortcut
Quote Reply
Re: [cK] use form to post username and password to .htaccess In reply to
The popup box is a feature of the server software, .htaccess and how some browsers handle "authentication required" headers.

You could set up your own username/password system that didn't use popups, but it couldn't be done via .htaccess

The sites listed at http://www.hotscripts.com/...User_Authentication/ will explain this subject in more detail.
Jan 17, 2003, 4:05 PM
cK
Enthusiast (567 posts)
Jan 17, 2003, 4:05 PM
Post #3 of 5
Views: 5049
Shortcut
Quote Reply
Re: [wysardry] use form to post username and password to .htaccess In reply to
You're responding to my question ?!
Jan 17, 2003, 4:17 PM
Paul
Veteran (19537 posts)
Jan 17, 2003, 4:17 PM
Post #4 of 5
Views: 5050
Shortcut
Quote Reply
Re: [cK] use form to post username and password to .htaccess In reply to
If you put the username and password into the url this data will be visible in the temporary internet files folder.

I just tested it out and it doesn't show up in my access_log, I just get the real URL.

Last edited by:

Paul: Jan 17, 2003, 4:18 PM
Jan 17, 2003, 4:25 PM
wysardry
User (228 posts)
wysardry's avatar
Jan 17, 2003, 4:25 PM
Post #5 of 5
Views: 5041
Shortcut
Quote Reply
Re: [cK] use form to post username and password to .htaccess In reply to
In Reply To:
You're responding to my question ?!
Er... yes. Why? Wasn't that what you wanted? Smile