On Wed, Feb 27, 2002 at 09:31:21PM +0100, Magnus Lie Hetland wrote: > I guess I'll just try with a .htpasswd file or > something (which should set the environment variables properly, I > guess.)
That's probably the best way to test it. But on a production server, putting the auth config in a <Location> directive in the webserver config file rather than an .htaccess file provides slightly better security. You can also turn off .htaccess parsing for a slight increase in speed. > > ** Users can't log out without quitting the browser. There's no way > > to provide a "logout" button because the browsers don't provide that > > feature. > > I've heard that said before... Wouldn't it be a simple matter of > providing the "unauthorized"/401 header/status again, and then have > the user clicking cancel? > > [...] > > ** Users can't relog in as someone else without quitting the browser. > > Ditto? A simple matter of who doing what? It'd be a simple matter for the browser to have an option that displays a list of servers/realms/usernames and lets you selectively delete them. That would make the browser forget the password and then you'd get the authentication dialog again. But AFAIK no browser does this, and you may not have the source code to the browser, or feel like modifying C code. -- -Mike (Iron) Orr, [EMAIL PROTECTED] (if mail problems: [EMAIL PROTECTED]) http://iron.cx/ English * Esperanto * Russkiy * Deutsch * Espan~ol _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
