HTTP Authentication ??

Anon

I don't understand how these variables are getting reset...On the first refresh I'm setting the user & pw to practically nothing, and on top of that I unset them. But if I refresh the page again : "Theeeeyy'ree Baaaack". What's going on here??

<?php
session_start();
session_register('logOut');

function authenticate() {
Header( "WWW-authenticate: basic realm=\"Test Authentication System\", stale=FALSE");
Header( "HTTP/1.0 401 Unauthorized");
echo "You must enter a valid login ID and password to access this resource\n";
exit;
}

if(!isset($PHP_AUTH_USER)) {authenticate();}

if ($logOut==1){
$PHP_AUTH_USER=" ";
$PHP_AUTH_PW=" ";
unset($PHP_AUTH_USER,$PHP_AUTH_PW);
$logOut=0;
}

echo "Hello $PHP_AUTH_USER.<P>";
echo "You entered $PHP_AUTH_PW as your password.<P>";
$logOut=1;
?>

Anon

By the way, i'm setting $logOut=1; on another page. So the first time it comes to this page $logOut is 1. And when it sets the Authentication variables it will set $logOut to 0. When the page is refreshed $logOut will still be 0, thus bypassing the setting of Authentication variables. And when it bypasses the setting of them they still have the original values that i typed in the authentication boxes....it's just weird.

brandonschnell

401 Auth is handled client side. when the client browser receives a HTTP 401 error it then prompts the user for username/password. next, it caches the username/password and resubmits the orginal page. any requests to pages on that site with the same domain(realm) the web browser will submit the cached username & password.

in short, you can't really log someone out using basic authentication. to prompt the user again for username/password or to clear the username/password cache change the domain thats sent with the 401.
but this will force the browser to prompt for username/password again and confuse the user.

long term, consider using a session/cookie logon system on a https page thats described in places like:
http://www.phpbuilder.com/columns/tim20000505.php3