Re: Authentication

[Micah Yoder <LYoder@cyberis.net>]

"Aaron D. Turner" wrote:

> > Well... PHP *is* a module...
> 
> Let me re-phrase that.  Only modules can supporrt http auth.  The PHP

Yep.  Anything that can parse the HTTP headers can get the auth info. 
PHP does it, and passes it to the script in variables, as I just
mentioned.

> module would have to have a hook into Apache to support that.  Apache has
> something like 14 steps to process a request.  One of those is
> authorization, which occurs *before* the page is read by Apache.  Hence,
> you can't do the http auth using PHP code inside the page.

Apache will *always* run the script.  It's up to the script to reject a
user.  Exactly as our form login code would do.

Basically the only difference is that the browser will transmit auth
info with every request after the first time it's needed.  When needed,
we'll check it - when we don't, we won't.  No silly cookies, no silly
URLs!

> Oh, btw, I haven't heard yet from Chris DiBona re: Slashdot and MySQL and
> the memory leak.  The good news is that I should get the change to ask Rob

I guess that's not essential anymore since I re-did the insert
statement.  Would still be nice to upgrade though.

> Malda in person tonight.  Slashdot say's he'll be at a cafe walking
> distance from my apartment starting at 7 tonight.

CRAP, I would REALLY love to be there.

***rumor alert*** - expect Yet Another Bombshell Anouncement(TM) from
IBM tomorrow.  It's gonna be sweet.........