note 60592 deleted from features.http-auth by sp
| From: | sp@php.net | Date: | Fri, 27 Jan 2006 09:27:48 +0000 |
| Subject: | note 60592 deleted from features.http-auth by sp | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-102533@lists.php.net to get a copy of this message | ||
Note Submitter: notter at thisaddress dot com
----
Here's a variation on Brian's method below:
<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorized users only';
exit;
} else {
session_start();
if ($_SESSION['destroy']=="doit") {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
session_unset();
session_destroy();
echo 'Authorized users only';
exit;
}
// user lookup goes here
// if user is good {
// page content goes here
} else {
header('WWW-Authenticate: Basic realm="This address"');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorized users only';
exit;
}
}?>
Then a separate logout.php page goes like:
<?php
if (!isset($_GET['quit'])) { ?>
<h4>To complete your log out, please select "Cancel" at this <a
href="logout.php?quit=y">log in prompt</a>.
<blockquote>Note: Logging in from that particular prompt is disabled! Only
"Cancel" will work there.</blockquote>
<p>Go <a href="/">back to the site</a>.</h4>
<?php
} else {
header('WWW-Authenticate: Basic realm="Log Out - Press Cancel"');
header('HTTP/1.0 401 Unauthorized');
session_start();
$_SESSION['destroy']="doit";
echo "<h3>Logged out!</h3><h4>Go <a href=\"/\">back
to the site</a>.</h4>";
}
?>
So far this absolutely works in IE and Moz and Lynx - the back button will not return to the logged
in session. Of course this depends on sessions being enabled, and probably should be restricted to
cookie-only sessions or else just removing the PHPSESSID from the URL might get around it. Also, if
the server is configured to time out the PHP session, that back button just might work afterwards.
Haven't tested for that.