note 10377 deleted from features.http-auth by irc-html

Combining other notes on this page into one place, here's the stub I use: <?php if ($PHP_AUTH_USER != "username" || $PHP_AUTH_PW != "password" || $logoff==1) { header("Status: HTTP/1.0 401 Unauthorized"); if (!($logoff==1)) { header("WWW-Authenticate: Basic realm=\"reporting (".strftime("%r",time()).")\""); echo "You must log in for reports.\n"; } else { echo "You are now logged off the reporting system.\n" echo "For complete security, please close all your browser windows.\n"; unset($PHP_AUTH_USER); unset($PHP_AUTH_PW); } exit; } echo "Welcome, you're in.\nPHP_AUTH_USER = $PHP_AUTH_USER\n$PHP_AUTH_PW = $PHP_AUTH_PW\n"; echo "<hr><a href=\"$PHP_SELF?logoff=1\">Log off</a>"; ?> Note two interesting tweaks I've found: 1. Testing this on a local Apache install (Win 32!) will not produce the authentication dialog. Uploading the same code to a server running Apache under FreeBSD and trying it from there works fine. 2. I'm using IE5 on Windows Me (talk about the "ultimate" development platform, ha ha) and IE5 really, really wants to help by putting in the username and password for you. Even after logging off by unsetting the variables and passing a 401 header, the browser remembers the username/password... even after closing that browser window! You have to close all browser windows (effectively stopping the execution of all IE5 processes on your Windows box) to make it forget. I indicated as much in the info to users, but note that it can be a real pain if people are surfing with more than one window open. Of course, if you want high security, you probably aren't using HTTP authentication anyhow, but fyi... enjoy, Eric Mueller eric@themepark.com