note 60592 added to features.http-auth
| From: | notter at thisaddress dot com | Date: | Wed, 11 Jan 2006 23:20:50 +0000 |
| Subject: | note 60592 added to features.http-auth | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-101586@lists.php.net to get a copy of this message | ||
Here's a variation on Brian's method below:
<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorized users only';
exit;
} else {
session_start();
if ($_SESSION['destroy']=="doit") {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
session_unset();
session_destroy();
echo 'Authorized users only';
exit;
}
// user lookup goes here
// if user is good {
// page content goes here
} else {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorized users only';
exit;
}
}?>
Then a separate logout.php page goes like:
<?php
if (!isset($_GET['quit'])) { ?>
<h4>To complete your log out, please select "Cancel" at this <a
href="logout.php?quit=y">log in prompt</a>.
<blockquote>Note: Logging in from that particular prompt is disabled! Only
"Cancel" will work there.</blockquote>
<p>Go <a href="/">back to the site</a>.</h4>
<?php
} else {
header('WWW-Authenticate: Basic realm="Log Out - Press Cancel"');
header('HTTP/1.0 401 Unauthorized');
session_start();
$_SESSION['destroy']="doit";
echo "<h3>Logged out!</h3><h4>Go <a href=\"/\">back
to the site</a>.</h4>";
}
?>
So far this absolutely works in IE and Moz and Lynx - the back button will not return to the logged
in session. Of course this depends on sessions being enabled, and probably should be restricted to
cookie-only sessions or else just removing the PHPSESSID from the URL might get around it. Also, if
the server is configured to time out the PHP session, that back button just might work afterwards.
Haven't tested for that.
----
Manual Page -- http://www.php.net/manual/en/features.http-auth.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+60592
Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=added+to+the+manual
Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=bad+code
Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=spam
Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=useless
Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=non-english
Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes&reason=already+in+docs
Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+60592&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+60592&report=yes
Search -- http://master.php.net/manage/user-notes.php