note 28411 added to features.http-auth

Here is my solution - works in MSIE and Mozilla. I use http-authentication only for the first time user accesses his private page; after valid username and password are provided, he is recognized using his sessionID and ip ... the reasons are following: 1) when users changes his password it is not required instantly (I find this quite comfortable) 2) auto-login function works fine (unless user click logout) And here's how i works ... The "trick" is to pass a temporary username+password to the browser. (I call it "temporary" because no user account matching these parameters is neccessary.) The most essential thing is the following link on user's private page: === <? $url = "http://". $username. // see note 1 ":". Session_ID(). // see note 2 "@localhost/".PROJECT_NAME."/logout.phtml"; ?> <a href="<?=$url?>">logout</a> === 1) we pass the actual username because MSIE uses this username as a "default pre-fill" for the login-window and some hash-string would confuse the users. 2) the temporary password is not too important, but there are two things we expect from it: a) we need to know this string in the logout.phtml script b) the string definetely should not match the user's password (otherwise user gets logged back instantly); using current Session_ID() we are pretty sure this won't happen This link causes that the temporary login-params are available in the logout.phtml script. Using "www-authenticate" header in the logout.phtml script we force the browser to accept our temporary login-params. (I suppose browser actually repeats the request and the next time it checks the login-params sent in the URL; but this is only my guess and it is not important.) The logout.phtml code: === <? $query = "UPDATE users SET sessionID = NULL ". "WHERE sessionID = '".Session_ID()."'"; $mysql->query($query); // because we (me :o) use the sessionID and the ip for // the identification we need to clean the sessionID; (I found it // a little bit easier to destroy the sessionID in the db than // unsetting the cookie and/or destroying+restarting // the current session) if($PHP_AUTH_PW != Session_ID()) { // keep asking for the login-params untill PHP_AUTH_PW returned // by the browser matches the current Session_ID() (which means // that the browser accepted the temporary login-params // we sent to it AND FORGOT THE REAL ONES) Header("HTTP/1.0 401 Unauthorized"); Header("WWW-Authenticate: Basic realm=\"".PROJECT_NAME."\""); } ?> <html> <head> <meta http-equiv="author" content="yaroukh at email dot cz"> <title><?=PROJECT_NAME?></title> <link rel="stylesheet" href="style.css" type="text/css"> </head> <body> <a href="http://localhost/<?=PROJECT_NAME?>/main.phtml">continue</a> </body> </html> === About the "continue" link: the link is not too important, but using it we can get rid off the temporary login-params which wouldn't look too aesthetically in the address-bar. :o) -- http://www.php.net/manual/en/features.http-auth.php http://master.php.net/manage/user-notes.php?action=edit+28411 http://master.php.net/manage/user-notes.php?action=delete+28411 http://master.php.net/manage/user-notes.php?action=reject+28411