Authentication Via Cookies On Apache?

Authentication Via Cookies On Apache?

Post by Cohn med » Sun, 05 Dec 1999 04:00:00



Would anyone have any suggestions on how to do the following:

Be able to control client browser access to various document files and
directories on an  Apache webserver by means of registration cookies, so that
if the browser sends the appropriate cookie, access will be granted, otherwise,
an error page comes up, displaying links to a registration form.  

This way, users who have pre-registered with the site would not need  to type
in their user ID and Password into a browser dialog box, such as is required if
one uses the straightforward HTTP authentication facilities associated with the
Apache auth modules.

I know of a few sites such as the New York times site (www.nytimes.com) that
appear to be doing this. But these are non-apache sites.

I have an assignment to add cookies-based capability such as this to a server
that contains  thousands of older html documents in an archive directory
hierarcy.With my limited current knowledge on the subject,  I am concerned it
might be necessary  to modify each one to include some new dynamic SSI
technology such as PHP or server side Java servlets to process the cookie
information.  As a C programmer, I have considered working with the Apache API
to modify the authentication routines, but am very unsure of my abilities to
succeed with such a revision without seriously breaking something in Apache.

Might anyone have any suggestions as to how this might best be done?  Are there
any add-on modules or patches which can provide this capability to the Apache
server that anyone might know of?

Thanks,

David Cohn

 
 
 

Authentication Via Cookies On Apache?

Post by ASTY Patric » Mon, 06 Dec 1999 04:00:00


Take a look at modules.apache.org:

        http://modules.apache.org/search?id=3

        http://modules.apache.org/search?id=4

Hope this help...
--
ASTY Patrick


> Would anyone have any suggestions on how to do the following:
> Be able to control client browser access to various document files and
> directories on an  Apache webserver by means of registration cookies, so that
> if the browser sends the appropriate cookie, access will be granted, otherwise,
> an error page comes up, displaying links to a registration form.


 
 
 

1. Q: proxy authentication via cookies/cgi ??

Can I run a proxy server, preferably apache, that authenticates
the browser by running a cgi-script to check a cookie?
And even better, if I can be greedy, I'd like the
proxy request to be made via ssl, even if the final
requested url is http.

Basic idea:
  1. Browser obtains a cookie, whose domain is that of the proxy server.
  2. Browser makes proxy request, sending along said cookie.
      (Does this really happen?  Would a cookie be sent to a proxy
      server if the cookie domain were for the proxy and not for
      the requested url?)
  3. Server runs a cgi script to examine the cookie.  If successful,
     processing of the proxy request continues as normal.  If failure,
     browser is redirected to site to get valid cookie.

So, can I do this with existing apache directives?  The docs aren't
very clear.  Do browsers act this way regarding cookies and proxy
requests?  And finally, can I tell a browser to use https://proxy.com
when requesting a normal http://some.url.com/  ?

I don't want to fill space with details, but I prefer  cgi/ssl instead
of basic auth because the (complicated overall) scheme is more secure.

   Bob Goldstein

2. remove dead comment

3. Apache, Oracle, Cookies and User Authentication

4. 12-bay diskpack on Ultra 2

5. cookies for authentication?? on the APACHE server

6. I NEED Source code for Silver PLUS

7. Apache and Cookie Authentication

8. Help with gdb!

9. user authentication in apache with cookies

10. Apache: using cookies for authentication

11. setting cookies via SSI (Apache 1.2b10)

12. Setting cookie via SSI-called script in Apache

13. My linux+Apache+mod_perl cannot recognize"print "Set-Cookie: cookie-name = Unique; "