You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jeff Sherk Forerunner Ministries <je...@ForerunnerTV.com> on 2009/08/26 14:58:58 UTC
[users@httpd] Can you supply username & password for AuthType Basic within a POST/GET?
When requiring a username & password with AuthType Basic, is it possible
to include them in a POST or GET request to the server so that it won't
ask for them (because they were provided)?
If it's possible, what variable names are assigned to them.
Thanks
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Nick Kew <ni...@webthing.com>.
Jeff Sherk Forerunner Ministries wrote:
> When requiring a username & password with AuthType Basic, is it possible
> to include them in a POST or GET request to the server so that it won't
> ask for them (because they were provided)?
You seem to be asking for form-based authentication.
One option for that is mod_auth_form, at
http://httpd.apache.org/docs/2.3/mod/mod_auth_form.html
--
Nick Kew
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Mike Cardwell <ap...@lists.grepular.com>.
On 26/08/2009 13:58, Jeff Sherk Forerunner Ministries wrote:
> When requiring a username & password with AuthType Basic, is it possible
> to include them in a POST or GET request to the server so that it won't
> ask for them (because they were provided)?
No, it is not possible. You could theoretically write your own
authentication module to do it though.
--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Eric Covener <co...@gmail.com>.
On Wed, Aug 26, 2009 at 8:58 AM, Jeff Sherk Forerunner
Ministries<je...@forerunnertv.com> wrote:
> When requiring a username & password with AuthType Basic, is it possible to
> include them in a POST or GET request to the server so that it won't ask for
> them (because they were provided)?
>
> If it's possible, what variable names are assigned to them.
No, basic authentication credentials have to come in over the
prescribed HTTP header, not as part of a query string or POST body.
A browser will allow you to encode them into the URL
(http://user:pass@example.com/foo), and will pass them to the
webserver without prompting you.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Jeff Sherk Forerunner Ministries <je...@ForerunnerTV.com>.
Thanks Andre, Mike, Eric and Nick... I will read up on authentication so
I can better grasp it!!
André Warnier wrote:
> Jeff Sherk Forerunner Ministries wrote:
>> When requiring a username & password with AuthType Basic, is it
>> possible to include them in a POST or GET request to the server so
>> that it won't ask for them (because they were provided)?
>>
>> If it's possible, what variable names are assigned to them.
>>
> Jeff,
> I believe you have a bit more studying to do in terms of HTTP
> authentication scriptures.
>
> I recommend to you the following on-line documents, in that order :
> a) http://en.wikipedia.org/wiki/Basic_access_authentication
> b) http://httpd.apache.org/docs/2.2/howto/auth.html
> c) http://tools.ietf.org/html/rfc1945#section-11.1
>
> The truth is in there. Unfortunately, these documents can be a bit
> hermetic to the non-initiated, so here is a short introduction :
>
> On a webserver, you usually define different areas containing
> documents, and corresponding URLs to access them.
> In Apache, these areas and URLs correspond more or less to
> configuration sections such as <Directory> and <Location>.
> (You can also use a .htaccess file inside of the directory itself, but
> that is frowned upon if you have access to the main webserver
> configuration).
>
> If you want to protect access to such a Directory or Location, you can
> specify rules, as described in (b) above.
>
> For the "basic" type of authentication, ("AuthType Basic"), the
> parameter : "AuthName xxxxxxxxxxxx" is also very important.
>
> You can have different server areas which are covered by the same
> "AuthName". This is like in a building, you could have different
> rooms marked "Prophets Only", while other rooms are marked "Mere
> Converts OK".
> As soon as one has authenticated for one of the "Prophets Only" areas,
> he is allowed to access any other room marked "Prophets Only", without
> needing to supply his credentials again.
>
> The way it works, is that a browser "remembers" that it has already
> accessed one of the "Prophets Only" areas previously within the same
> browser session.
> So when he accesses a new area, when the server responds that for this
> one, one needs a "Prophets Only" authentication, the browser just
> looks in its cache to see if it already has one of those, and if yes,
> it re-issues the same request again, without user intervention, but
> this time with the appropriate request header providing his "Prophets
> Only" authentication credentials.
> This all happens automatically, without the user even noticing.
>
> It is only the first time that the browser accesses a "Prophets Only"
> area, that it does not find this in its cache, and has to ask the user
> to provide a user-id and password.
>
> So, to get back to your original question above :
> - you do not need to do anything special to get this behaviour, other
> than making sure that the different areas of your server which you
> want to be covered by the /same/ credentials, use the /same/
> "AuthName" value.
> - there are no "variables" assigned to this. It happens via HTTP
> headers which the browser automatically adds to the request, when
> applicable.(*)
>
> Now I suggest that you re-read document (b) above once more, hoping
> that with this short overview it will now be more accessible.
>
>
> (*) This is not entirely true. It is generally the case, when a
> request has been "authenticated" by Apache, that a script running
> under Apache can access the authenticated user-id assigned to this
> request.
> To see how however, you will have to consult yet more documentation,
> depending on the programming language these scripts are written in.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by "William A. Rowe, Jr." <wr...@rowe-clan.net>.
Jeff Sherk Forerunner Ministries wrote:
> Per Erics earlier response, if I encode the username and password in the
> URL with https instead of
> http, is it secure?
>
> Like this https://username:password@mydomain.com/foo
Provided you are using https: SSL or TLS Upgrade you are assured it is
secure because nothing has been transmitted before handshaking is complete.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Jeff Sherk Forerunner Ministries <je...@ForerunnerTV.com>.
Per Erics earlier response, if I encode the username and password in the URL with https instead of
http, is it secure?
Like this https://username:password@mydomain.com/foo
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by Jeff Sherk Forerunner Ministries <je...@ForerunnerTV.com>.
Thanks William... yes we are using SSL... just wanted to make sure it
was secure as well!
Thanks
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Can you supply username & password for AuthType
Basic within a POST/GET?
Posted by André Warnier <aw...@ice-sa.com>.
Jeff Sherk Forerunner Ministries wrote:
> When requiring a username & password with AuthType Basic, is it possible
> to include them in a POST or GET request to the server so that it won't
> ask for them (because they were provided)?
>
> If it's possible, what variable names are assigned to them.
>
Jeff,
I believe you have a bit more studying to do in terms of HTTP
authentication scriptures.
I recommend to you the following on-line documents, in that order :
a) http://en.wikipedia.org/wiki/Basic_access_authentication
b) http://httpd.apache.org/docs/2.2/howto/auth.html
c) http://tools.ietf.org/html/rfc1945#section-11.1
The truth is in there. Unfortunately, these documents can be a bit
hermetic to the non-initiated, so here is a short introduction :
On a webserver, you usually define different areas containing documents,
and corresponding URLs to access them.
In Apache, these areas and URLs correspond more or less to configuration
sections such as <Directory> and <Location>.
(You can also use a .htaccess file inside of the directory itself, but
that is frowned upon if you have access to the main webserver
configuration).
If you want to protect access to such a Directory or Location, you can
specify rules, as described in (b) above.
For the "basic" type of authentication, ("AuthType Basic"), the
parameter : "AuthName xxxxxxxxxxxx" is also very important.
You can have different server areas which are covered by the same
"AuthName". This is like in a building, you could have different rooms
marked "Prophets Only", while other rooms are marked "Mere Converts OK".
As soon as one has authenticated for one of the "Prophets Only" areas,
he is allowed to access any other room marked "Prophets Only", without
needing to supply his credentials again.
The way it works, is that a browser "remembers" that it has already
accessed one of the "Prophets Only" areas previously within the same
browser session.
So when he accesses a new area, when the server responds that for this
one, one needs a "Prophets Only" authentication, the browser just looks
in its cache to see if it already has one of those, and if yes, it
re-issues the same request again, without user intervention, but this
time with the appropriate request header providing his "Prophets Only"
authentication credentials.
This all happens automatically, without the user even noticing.
It is only the first time that the browser accesses a "Prophets Only"
area, that it does not find this in its cache, and has to ask the user
to provide a user-id and password.
So, to get back to your original question above :
- you do not need to do anything special to get this behaviour, other
than making sure that the different areas of your server which you want
to be covered by the /same/ credentials, use the /same/ "AuthName" value.
- there are no "variables" assigned to this. It happens via HTTP
headers which the browser automatically adds to the request, when
applicable.(*)
Now I suggest that you re-read document (b) above once more, hoping that
with this short overview it will now be more accessible.
(*) This is not entirely true. It is generally the case, when a request
has been "authenticated" by Apache, that a script running under Apache
can access the authenticated user-id assigned to this request.
To see how however, you will have to consult yet more documentation,
depending on the programming language these scripts are written in.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org