Re: Logout with auth_HTTP

I've found the Auth documentation to be somewhat poor in that respect as well. What I've done is create a separate authenticateUser.php file that I include at the top of each page I want restricted. It's based off of the documentation's examples but puts them together in a way that works, whereas the documentation is all piecemeal. Also, I found that the precise location of certain method calls is extremely important. Put the second start() call in the wrong place and you get the same symptoms you describe. An abridged but hopefully fully functional version of the file is included below. Feel free to use it verbatim or modify if you need. -------------------------------------- <?php require_once('Auth.php'); /** * Display the login page * * @author Larry Garfield */ function showLoginPage() { // Various print statements, or template call, or some output. // This sends an ENTIRE valid page. } // Set up a new Auth session, based on our installation configuration $params = array( "dsn" => 'yourstringhere', "table" => 'Users', "usernamecol" => 'username', "passwordcol" => 'passwdcrypt' ); $auth = new Auth("DB", $params, "showLoginPage"); $auth->setSessionName("MYAPP" . "_SESSION"); // Start the authentication process, meaning display the login page if necessary $auth->start(); // If told to log out, do so // This is a bit sloppy since you can't guarantee that $_GET['task'] // exists. I use a separate utility class to get the value safely, // which I left out here for brevity. if ($_GET['task'] == "logout" && $auth->checkAuth()) { $auth->logout(); $auth->start(); // Restart the login (this must be here!) } // If the second $auth->start() call is here instead of above, I get // the symptom you describe. // If the user is not already authenticated, they don't get to see // anything else if (! $auth->checkAuth()) { exit(); // We don't want to show anything but the login page } ?> -------------------------------------- Jonathan Loran wrote:

Hi all, I'm more or less a newbie to PEAR and PHP. What is the canonical method to have a user sign out once they are authenticated with Auth_HTTP? I found the auth:logout() function, but it doesn't seem to actually log the user out. When I reload the secure page, no password is asked for. What am I missing? Thanks in advance for any guidance. Jon

-- Larry Garfield AIM: LOLG42 larry@garfieldtech.com ICQ: 6817012 "If nature has made any one thing less susceptible than all others of exclusive property, it is the action of the thinking power called an idea, which an individual may exclusively possess as long as he keeps it to himself; but the moment it is divulged, it forces itself into the possession of every one, and the receiver cannot dispossess himself of it." -- Thomas Jefferson