[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Authentication
-----BEGIN PGP SIGNED MESSAGE-----
On Sat, 27 Feb 1999, Micah Yoder wrote:
> I'm a bit perplexed who you folks haven't seriously considered HTTP
> authentication. It has its advantages: It allows persistent logins
Weren't you there when we discussed this via IRC? We shot it down then,
but I'd be willing to re-open discussions. The main problem with http
auth, is inserting records and verification. Flat files will not give us
the performance we need. This gives us two options:
Berkely DB
MySQL
Berkely DB has the problem of being another DB we have to learn/write/find
a API for. It also means that we need two DB's with the same info in it--
stupid IMHO.
MySQL has the advantage that there already is a module for MySQL http
auth via mod_perl. Realize that you can't do this in PHP unless there is
a special Apache Module for that. Http auth runs in the http server space
not CGI space; hence the need for the module.
> without cookies OR relying on dynamic pages propagating messy URLs! PHP
> supports it well, and I suppose Perl does also.
Negative mucacho. Neither Perl nor PHP support HTTP auth. HTTP auth
occurs *BEFORE* the CGI gets executed. Only modules support http auth.
Also, there is a Perl mod_perl module that avoids "cookies and messy
URL's". The cool thing about the module (and the example code in one of
the Perl Journals) is that the user only has to bookmark the URL and that
become his "key". You just take a hash of the userid and IP address, and
you have a reasonably secure authentication method that only requires a
single variable=value construct. Of course it don't work so well with
PHP!
> It's supported by
> Lynx. Frankly, I can't think of any disadvantages. Can someone
> enlighten me? If not, why not just use it? My online broker uses it -
> so it must be a good solution.
Well the advantage is that it allows us to use Perl or PHP wherever it
suits us. I would expect finding a cross language state machine would be
difficult.
> Also, I still haven't figured out how to check passwords with MySQL. I
> haven't looked much since the last time I asked. But if someone has
> some code, that would be great.
Don't look at me :-)
- --
Aaron Turner | Either which way, one half dozen or another.
aturner@pobox.com | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed. Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80 59 6E 60 BF 45 1B 20 E8
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNtkNNDM3jpXy1kJtAQF3+wP/Rl7cC5q3az8KT+mWezklW9yR/qgWjgMZ
Zo3EnR07F1xx0j1tZu5UzIx4uvmo7rhWL4hDjwSpfjuo2Np+ddgMpnbEpmpZwPIa
sQdiR6gedlKKvEywvTXZ9pVj8bf6fdBkBDu1owamnqV2YVLS1kq6F07qTVxuKhJ4
dNJ7e6Q4eec=
=On5z
-----END PGP SIGNATURE-----