Re: Digest Authentication

Hello, On 08/22/2002 05:06 PM, Seairth Jacobs wrote:

No, I had not meant NTLM authentication. However, support for this wouldn't hurt as well, I suppose. What I am looking to do is something like the following: if browser supports digest authentication

    use digest authentication

else

    use basic authentication

Just specify both methods by that order and the browser will use the first that it supports.

right now, though, it looks like I will be using basic authentication only, since most browsers support it. If it becomes necessary, I will use SSL to encrypt both the authentication headers (and everything else), but I would like to avoid this if possible. In my case, I am more concerned about someone stealing login information that I am about someone seeing something they shouldn't see. With basic authentication, there is a risk of the first. With digest authentication (done properly), there is only a risk of the second. And since most of the viewable data will be public anyhow, this is not much of a concern... for now...

If you can use NTLM authentication it could be a good thing because it would not require users to enter passwords to access your site. PHP does not have built-in support for it, but there are Web server modules that support it and even handle credentials caching for you. Anyway, if you are looking for a more browser independent message, you may want to try using forms based authentication using md5 to encrypt the passwords. It will require a Javascript enabled browser but that is more than 95% of the browsers. Here you may find an example that works that way: http://www.phpclasses.org/login.html Here you may find a forms class with an example that demonstrates how that kind of authentication can be used. -- Regards, Manuel Lemos