Re: [PHP4BETA] The realm code in WWW-Auth
| From: | Rasmus Lerdorf | Date: | Thu, 01 Jan 1970 00:00:00 +0000 |
| Subject: | Re: [PHP4BETA] The realm code in WWW-Auth | ||
| References: | 1 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-829@lists.php.net to get a copy of this message | ||
> Rasmus - can you explain the PHP 3.0 code that plays with the realm part of
> the WWW-Authenticate header? Why not just send it as-is?
The realm is only changed in safe-mode where the uid of the owner of the
script being executed is prepended. This is to prevent someone on a
shared server from harvesting passwords by simply copying the realm from
another page on the same server and putting up an http-auth page.
-Rasmus
--
PHP 4 Beta