problem with Apache2::AuthCookie

[Brian Clarkson <br...@lnstar.com>]

I started having an odd problem with a simple subclass of
Apache2::AuthCookie after a mod_perl upgrade.  

When authorization fails, apache apparently returns a forbidden page to
the user (not just a forbidden status to the authentication hook) then
fails to redirect the user back to the login page.  The browser actually
displays the following:


ody> <h1>Forbidden</h1> <p>You don't have permission to access /archive/
on this server.</p> <p>Additionally, a 200 OK error was encountered
while trying to use an ErrorDocument to handle the request.</p> <hr>
<address>Apache Server at www.psychonomic.org Port 80</address>
</body></html> HTTP/1.1 200 OK Date: Mon, 27 Jul 2009 19:54:27 GMT
Server: Apache Keep-Alive: timeout=15, max=88 Connection: Keep-Alive
Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 fd6
<!-- psychonomic.org/templates/archive/frontpage.tmpl -->
(The code can be seen in action at http://www.psychonomic.org/archive )

Authorization only seems to fail 1 out of 50 times.  A similar error
happens when the 'Continue' button on the page is pressed repeatedly (5+
times) without checking the 'I agree' checkbox.

I only need to make sure the user has checked a box agreeing to the
website's terms and conditions.  I don't use any kind of user/pass
combinations.  

perl 5.8.8
apache 2.2.11
mod_perl 2.0.4


My module code is:

package TermsAndConditions;
use strict;
use Apache2::compat;
use base qw! Apache2::AuthCookie !;

sub authen_cred ($$\@) {
   my $self = shift;  # Package name (same as AuthName directive)
   my $r    = shift;  # Apache request object
   my @cred = @_;     # Credentials from login form

   return ( $cred[0] ? "authorized" : undef );
}

sub authen_ses_key ($$$) {
   my ($self, $r, $session_key) = @_;
   return 1;
}

1;

The relevant httpd.conf directives are:

<Directory /home/httpd/psychonomic.org/modperl_apps>
   <Files login.pl>
      SetHandler perl-script
      PerlHandler ModPerl::Registry
      Options +ExecCGI
      allow from all
      PerlSendHeader On
   </Files>
</Directory>


<Files logout.pl>
   SetHandler perl-script
   PerlHandler ModPerl::Registry
   Options +ExecCGI
   PerlSendHeader On
</Files>

## These documents require user to be logged in.
<Directory /home/httpd/psychonomic.org/html/archive>
    Options +ExecCGI
    AuthType TermsAndConditions
    AuthName PsychoMembers
    PerlAuthenHandler TermsAndConditions->authenticate
    PerlAuthzHandler TermsAndConditions->authorize
    require valid-user
    #SetHandler perl-script
    #PerlSendHeader On
</Directory>

##this is the action of the login.pl script above.
<Location /apps/LOGIN>
    AuthType TermsAndConditions
    AuthName PsychoMembers
    SetHandler perl-script
    PerlSendHeader On
    PerlResponseHandler TermsAndConditions->login
</Location>