Mike Orr <[EMAIL PROTECTED]> wrote: > Some disadvantages of Basic Authentication: > > ** You can't customize the login dialog except the short "realm name" > string. If users are confused about why they are being asked for a > password, there's no way to provide a "click here for help" hyperlink. > > ** Users can't log out without quitting the browser. There's no way > to provide a "logout" button because the browsers don't provide that > feature. If a user goes to lunch and leaves their browser open, a creep > can sit at their desk and have all their privileges. > > ** Users can't relog in as someone else without quitting the browser. > This may be necessary for some applications.
In fairness to Basic Authentication, these criticisms are not of Basic Authentication itself, but of Web browsers and how they have implemented the client functions of Basic Authentication. There is certainly nothing in the Basic Authentication protocol that prohibits browsers from implementing a "log out" function that purges their userid/passwd for a Domain (in fact, we have a wxPython SOAP client that does exactly that). Also (somewhat off-topic) if there is a potential for a "creep" to sit at someone's desk while they are at lunch, then I'd say probably *minimal* physical security would be to lock their screen, which takes care of this problem and also potentially more serious ones! -- Steve. Stephen C. Waterbury Code 562, NASA/GSFC WWW: http://misspiggy.gsfc.nasa.gov/people/waterbug.html _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
