Apache & redirect upon basic auth cancel button

Apache & redirect upon basic auth cancel button

Post by Kyle Tuck » Fri, 19 Jun 1998 04:00:00



Hi,
        I am running Apache 1.2.5 on Solaris 2.5.1. I've seen threads
on this with no conclusive methods on how to do it and I hit a site
the other day (http://www.nwfusion.com/forum/merger), that sent me to
a different page when I hit the Cancel button on the basic authentication
popup window. Can someone tell me how this is done? I've looked at the
ErrorDocument directive, as was mentioned in one of the threads, but
can't get it to act in this manner. A snoop shows the next thing from
the server after I get the auth popup is a "302 Moved temporarily" but
I can't get Apache to return this, but then I'm not sure ErrorDocument
is triggered by a cancel button. Thanks.

--
- Kyle
--------------------------------------------------------------

--------------------------------------------------------------
--
PLEASE NOTE: comp.infosystems.www.authoring.cgi is a
SELF-MODERATED newsgroup. aa.net and boutell.com are
NOT the originators of the articles and are NOT responsible
for their content. You can SELF-APPROVE your first posting
by writing the word 'passme' on a line by itself.

 
 
 

Apache & redirect upon basic auth cancel button

Post by Rasmus Lerdo » Sat, 20 Jun 1998 04:00:00


Quote:>    I am running Apache 1.2.5 on Solaris 2.5.1. I've seen threads
> on this with no conclusive methods on how to do it and I hit a site
> the other day (http://www.nwfusion.com/forum/merger), that sent me to
> a different page when I hit the Cancel button on the basic authentication
> popup window. Can someone tell me how this is done? I've looked at the
> ErrorDocument directive, as was mentioned in one of the threads, but
> can't get it to act in this manner. A snoop shows the next thing from
> the server after I get the auth popup is a "302 Moved temporarily" but
> I can't get Apache to return this, but then I'm not sure ErrorDocument
> is triggered by a cancel button. Thanks.

I don't think you can use a header-level redirect on a page that contains
WWW-authentication headers.  At least not reliably on all browsers.  I
bet the page you saw that did a META-tag redirect right from the code
that performed the authentication.  I have done that a number of times
and it works well.

For example, try going to http://www.lerdorf.on.ca/cancel.html

There is no possibility of actually getting a real login to go through
there because there are no valid users.  But if you hit cancel, or try
three times (or however many times your browser will let you keep trying)
then you will eventually be redirected to yahoo.

This is done by the following bit of PHP3 code which emulates an
Apache authentication module:

<?
    if(!isset($PHP_AUTH_USER)) {
        Header("WWW-authenticate: basic realm=\"Test\"");
        Header("HTTP/1.0 401 Unauthorized");
        ?>
<META HTTP-EQUIV="Refresh" CONTENT="0; URL=http://www.yahoo.com">
        <?
        exit;
    } else {
        $user_id=strtolower($PHP_AUTH_USER);
        $password=$PHP_AUTH_PW;
        /* You would check $user_id and $password here */
        Header("WWW-authenticate: basic realm=\"Test\"");
        Header("HTTP/1.0 401 Unauthorized");
        ?>
<META HTTP-EQUIV="Refresh" CONTENT="0; URL=http://www.yahoo.com">
        <?
        exit;
    }
?>

-Rasmus

 
 
 

Apache & redirect upon basic auth cancel button

Post by Kyle Tuck » Sat, 20 Jun 1998 04:00:00




Quote:

> This is done by the following bit of PHP3 code which emulates an
> Apache authentication module:

Per a suggestion by Ian Redfern, I tried using ErrorDocument 401
and this appeared to work; at first. If I use 401 and use a different
local URL than the one from which I called the authenticated URL, then
all works fine. If I use the same local URL (which I want so users
that hit cancel simply go back to same page) then there is never
an authentication pop-up, it just goes right to the redirect. ????
The second commented-out one is the URL from which this is called.
IF that is in place, the complete auth bypass occurs.

<Location /cgi-bin/status-update.pl>
ErrorDocument 401 /helpdesk/getlost.html
# ErrorDocument 401 /cgi-bin/nph-status.cgi
AuthType Basic
AuthName HelpDesk
AuthUserFile /usr/local/www/auth/helpdesk/.htpasswd
require user helpdesk
</Location>

--

- Kyle
--------------------------------------------------------------

--------------------------------------------------------------

 
 
 

1. Apache auth & deb auth problem?

Hi,
i got a apache (1.3.9) on debian (potato) running with many virtual Hosts,
everything ok so long.
But when i try to use basic authorisation via a .htaccess-file, i can't
access my site with any user. e.g.:
VHost slanschuetzer.gre-dv.at:

httpd.conf:

User www-data
Group www-data
.
.
LoadModule auth_module /usr/lib/apache/1.3/mod_auth.so
.
.
<VirtualHost 193.81.236.31>

DocumentRoot /var/www/slanschuetzer.gr-edv.at
<Directory />
        Options FollowSymLinks
        AllowOverride ALL
</Directory>
ServerName slanschuetzer.gr-edv.at
ErrorLog /var/log/apache/slanschuetzer.gr-edv.at-error.log
TransferLog /var/log/apache/slanschuetzer.gr-edv.at-access.log
</VirtualHost>

.htaccess:

AuthType Basic
AuthName "Fuer lanschue und magic zugaenglich."
AuthUserFile ./pwd
<Limit GET>
Require user valid-user
</Limit>

user lanschue and magic are entries in the
/var/www/slanschuetzer.gr-edv.at/pwd - file
and /var/www/slanschuetzer.gr-edv.at has the rights:

drwxrwxr-x    lanschue    wwwstaff ........

and when i try to access the site via a browser, i get no access and
following errors in my error-log:

[Sat Aug 17 18:18:32 2002] [error] [client 62.46.226.146] access to /
failed, reason: user magic not allowed access

(trying a user not in my pwd-file gives me the error: "user xxxx not found:
/" so my pwd-file is really read.

has anyone an idea, why my valid users don't get access?

thanks,
Stefan

2. First draft of Linux Laptop Mini-HOWTO available

3. Apache SSL / Basic auth

4. Library linking problem

5. Apache --> Tomcat Auth Basic header forwarding

6. New version of procps released

7. Apache: too many users in one group (Basic auth)

8. Plug-n-pray modems: Supra 336i

9. Problems w/ Directory Indexing and Basic Auth in apache 2.0

10. apache + php + basic auth => password theft => solutions?

11. Can apache send $PASSWORD with basic auth to cgi?

12. Virtual Host & Basic Auth

13. Apache Auth / Cookie auth