Re: $PHP_AUTH_USER

Hello! The answer can't be answered with a time spread, because: 1)The Browser requests for example foo.com/bar 2)The Webserver answeres: header("WWW-Authenticate: Basic realm=\"Stage-Members-Area\""); header("HTTP/1.0 401 Unauthorized"); print "YOU HAVE NO ACCESS\n"; 3) The Webbrowser pops up the User/Passwd dialogue and tries it again. 4) was 3) successfull (no more 401) the browser stores ffo.com/bar and sends for that Netscape/IE-session everytime username and password in the HTTP-header of ALL requests having foo.com/bar ! Therefore $PHP_AUTH_USER can't expire! It will be delete by the browser while closing it. BUT: If an IE user stores the password using the IE-passwd-storing function it is send every forthcoming session between that IE and foo.com/bar ! The onliest you can do is to store in a database (or textfile) that username and fore a "HTTP/1.0 401 Unauthorized" for the next login. After that you have to enable that username that the user can relogin. Then, also the IE-paswd-store-function asks the user to enter a valid password (because IE thinks that the password is invalid). regards Folke -- Folke Ashberg Stage Internet Services GmbH Technical Development folke@fanstage.de folke@fanstage.de | Tel: +49 89 454591-77 | Fax: +49 89 454591-71 Kreillerstr. 21 | 81673 Munich | Germany | www.fanstage.de On Mon, 27 Nov 2000, Mike wrote: > How long does $PHP_AUTH_USER persist?Can this be changed? > mpeloso@princeton.edu > > > >