note 50189 deleted from features.http-auth by nlopess
| From: | nlopess@php.net | Date: | Mon, 21 Feb 2005 20:06:34 +0000 |
| Subject: | note 50189 deleted from features.http-auth by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-85324@lists.php.net to get a copy of this message | ||
Note Submitter: x_terminat_or_3 at yahoo dot french
Reason: useless
----
If you make your logout a re-login but don't process it you don't have the problem of the
browser remembering the password!
Try this:
<?php
function login()
{if(@$_GET['logout']==='Logout')
{unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
header('WWW-Authenticate: Basic realm="My Realm"');
header('HTTP/1.0 401 Unauthorized');
echo "You are now loged out.\n";
exit;}
if(isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW']))
{#see if this is a valid user/password combo
$user=mysql_escape_string($_SERVER['PHP_AUTH_USER']);
$pass=mysql_escape_string($_SERVER['PHP_AUTH_PW']);
if(!($user==='someuser' && $pass==='somepass'))
unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);}
if(!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW']))
{header('WWW-Authenticate: Basic realm="Vlaamse Kern Nieuwsbrief"');
header('HTTP/1.0 401 Unauthorized');
echo "Error: login required!";
exit;}
login();
?>
Provide a logout option on the page like this:
<?php
echo <<<LOGOUTFORM
<form style="text-align: right" action="$_SERVER[SCRIPT_NAME]"
method="GET" enctype="application/x-www-form-urlencoded">
<input type="submit" name="logout" value="Logout">
</form>
LOGOUTFORM;
?>