svn commit: r1933751 - httpd/httpd/trunk/docs/manual/mod

[rb...@apache.org]

Author: rbowen
Date: Sat May  2 22:37:26 2026
New Revision: 1933751

Log:
mod_authn_core: note that modern browsers no longer display AuthName realm (Bug 69326)

Modified:
   httpd/httpd/trunk/docs/manual/mod/mod_authn_core.xml

Modified: httpd/httpd/trunk/docs/manual/mod/mod_authn_core.xml
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_authn_core.xml	Sat May  2 22:27:05 2026	(r1933750)
+++ httpd/httpd/trunk/docs/manual/mod/mod_authn_core.xml	Sat May  2 22:37:26 2026	(r1933751)
@@ -139,8 +139,12 @@ authentication</description>
      AuthName "Top Secret"
    </highlight>
 
-    <p>The string provided for the <code>AuthName</code> is what will
-    appear in the password dialog provided by most browsers.</p>
+    <p>The string provided for the <code>AuthName</code> was
+    historically displayed in the password dialog provided by
+    browsers. Most modern browsers no longer show the realm
+    string, as it could be abused for phishing. The directive
+    is still required for HTTP authentication to function, and
+    the realm value is still used to scope credentials.</p>
 
     <p>From 2.5.0, <a href="../expr.html">expression syntax</a> can be
     used inside the directive to produce the name dynamically.</p>