Mike Orr <[EMAIL PROTECTED]>: > > On Wed, Feb 27, 2002 at 09:31:21PM +0100, Magnus Lie Hetland wrote: > > I guess I'll just try with a .htpasswd file or > > something (which should set the environment variables properly, I > > guess.) > > That's probably the best way to test it. But on a production server, > putting the auth config in a <Location> directive in the webserver > config file rather than an .htaccess file provides slightly better > security. You can also turn off .htaccess parsing for a slight > increase in speed. It seems I'll have to do something like that anyway... Since the test document is served through WebKit (and not directly through Apache) the .htaccess file seems to be ignored.
[...] > A simple matter of who doing what? Sending the same headers as when asking for the password to begin with. > It'd be a simple matter for the > browser to have an option that displays a list of servers/realms/usernames > and lets you selectively delete them. Yes. I was talking about a server-side solution for todays situation. > That would make the browser > forget the password and then you'd get the authentication dialog again. > But AFAIK no browser does this, and you may not have the source code to > the browser, or feel like modifying C code. Sure. My point was that you probably can (although I haven't tested it) simply send an "unauthorized" header to the browser and have the user press cancel to make it forget the password. Not ideal, sure; but at least (if this really works ;) it isn't impossible to log out, or to re-login. -- Magnus Lie Hetland The Anygui Project http://hetland.org http://anygui.org _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
