Okay, I've read all I could find on the archive regarding HTTP auth, and it
seems we can't separate the pop-up box from the authentication, because the
pop-up box is part of the client, correct? But, what if PHP is the client,
that is, using fopen to open a url that requires http auth? Can I somehow
send a user name and pass to that URL.
I have never messed with a Lotus Server, but things seem to go like this..
1) the user requests a restricted page
2) the server sees the person needs a username/password
3) the server sends a 401 Unauthorized to the browser (this creates the pop-up box)
3b) the server also sends the browser the HTTP header "WWW-Authenticate: Basic Realm" (if the authentication methid is basic)
4) the user enters the username/password
5a) If the username/password is correct, the server lets the person through
5b) If the username/password are not valid, the server sends a 401 Unauthorized again with the proper HTTP headers
6) In each request that the browser makes, the browser sends a Request Header of "Authorization: base64hash" along with the request. The base64 hash contains the username and password separated by a ":"
6b) if the username/password are correct, the user is passed through, if they are incorrect, the server throws up the 401 response header again. and all starts over.
It appears that the browser caches the username/password once it realizes it sent the right username/password to the web server. There seems to be no way of "setting" this, without using a proxy or somehow filling in the pop-up box, and hitting submit fast enough where the user can't stop it all.
The above is at least what I have figured out. Corrections are welcomed. This makes it really really hard to use the same authentication across different servers, without a proxy.
benji
---
Benji Spencer
Web Programmer
Moody Bible Institute
312-329-2288