note 45965 deleted from features.http-auth by betz

Note Submitter: rentaprogrammer at yahoo dot com ---- I am not sure if this is possible, but I would appreciate knowing either way. My employer would like to block all files in a directory (including binaries) unless a user is authenticated. HOWEVER, we would prefer to not use the challenge/response authentication because our users already have one pair of user name/password. We ask the user for the name and password and validate them against our own MySQL database. Our login procedure locks unauthorized users out of viewing php pages, but if they knew a full URL of an image or binary file, we do not protect against that. Here is what we would like to do: Log a user in via PHP (our own login form, no HTTP authentication). Upon successful login, turn on access priveleges for certain protected directories. Nobody should be allowed to access our protected directory (including image and binary URL's) unless they have logged in through our PHP form. We do not want to subject a user to the "Basic Authentication" because we would have to maintain two sets of passwords. Is there a way to bypass the login dialog for basic authentication and send the login/password via PHP? If so, we would not need a different HTTP account for every user. Normally you can use PHP authentication to block access to web pages via session variables etc. However, if a user knows a direct URL of an image or binary file, he can still download those files without logging in.