Re: Basic Auth

On 27/08/13 15:37, Jim Giner wrote:
> I"m using basic auth for a few of my pages that I want to limit access
> to - nothing of a sensitive nature, but simply want to limit access to.
>   Want to implement a signoff process, but can't figure it out.
>
>  From the comments in the manual I take it one can't do this by simply
> unsetting the PHP_AUTH_USER and _PW vars.  Can someone explain to me why
> this doesn't suffice?  The signon process expects them to be there, so
> when they are not (after the 'unset'), how come my signon process still
> detects them and their values?

Hello Jim,

at the risk of under-estimating your knowledge (and over-estimating 
mine) of HTTP-requests in PHP - but here it goes.

I see two options of bypassing the JavaScript option.

The first one is to use the default authorization, and error pages of 
your HTTP server.
(For example, in Apache: 
http://httpd.apache.org/docs/2.2/custom-error.html)
This is for a login with invalid credentials.
For some-one to leave the protected site, a HTTP-request without 
credentials, and to a URI outside the protected domain, should do (as 
every HTTP request into the protected domain should repeat the 
Authorisation header).


The second one is to leave header(), and go down one level, to the likes 
of fsockopen() or stream_socket_server() - though personally, I've only 
limited knowledge of a bit of client-side programming.

Unless I've completely misunderstood your question,
Hope this helps,

Bert