You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Eric DOUTRELEAU <Er...@int-evry.fr> on 2002/06/16 17:48:26 UTC
Re: modperl Digest 15 Jun 2002 20:05:58 -0000 Issue 797
Hi
First thanks for your answer.
>
>Date: 14 Jun 2002 12:33:35 -0400
>To: modperl@apache.org
>From: Vivek Khera <kh...@kcilink.com>
>Subject: Re: location of LoginScript in Apache::AuthCookie* modules
>Message-ID: <x7...@yertle.kciLink.com>
>
>>>>>> "ED" == Eric Doutreleau <Er...@int-evry.fr> writes:
>
>ED> Right now i would like to make user authenticate throug a SSL
>ED> page.
>ED> In order to do that i modify the configuration script to use
>
>ED> PerlSetVar WhatEverLoginScript https://corbeau/perl/login.pl
>
>Well, in order to be able to get the original location, this has to be
>done via an internal redirect. When you switch protocols (ie, from
>http to https) you cannot do internal redirect.
>
I was indeed afraid of that.
>But really, your login page doesn't need to be ssl secured as there is
>no information in it. What you want is the target of the from in that
>page to be aimed at an SSL URL. That's the transaction you want
>secured, since that's where the id/password are sent.
>
Well
what i want to secure is the sending of the login/ password.
But i don t want at all to send the html pages in sll.
Therefore i want to switch on ssl for sending the login and password and
switch back to http after when i set the cookie.
Is that possible?
>--
>=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>Vivek Khera, Ph.D. Khera Communications, Inc.
>Internet: khera@kciLink.com Rockville, MD +1-240-453-8497
>AIM: vivekkhera Y!: vivek_khera http://www.khera.org/~vivek/
>
>------------------------------
Re: modperl Digest 15 Jun 2002 20:05:58 -0000 Issue 797
Posted by Vivek Khera <kh...@kcilink.com>.
>>>>> "ED" == Eric DOUTRELEAU <Er...@int-evry.fr> writes:
ED> what i want to secure is the sending of the login/ password. But
ED> i don t want at all to send the html pages in sll. Therefore i
ED> want to switch on ssl for sending the login and password and
ED> switch back to http after when i set the cookie. Is that
ED> possible?
All you need to secure is the submission of your password form. The
form page itself doesn't need to be secure. The redirect after the
authentication doesn't need to be secure.
That is, the only place you need an "https" URL is the TARGET="..." of
your form that collects your id/password.
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vivek Khera, Ph.D. Khera Communications, Inc.
Internet: khera@kciLink.com Rockville, MD +1-240-453-8497
AIM: vivekkhera Y!: vivek_khera http://www.khera.org/~vivek/