Re: Status & CVS & objects

[Micah K Yoder <LYoder@cyberis.net>]

Jason Pincin wrote:

> Yeh - we can't require cookies.  crypt is cool - I assume your going to be
> storing passwords via php's crypt() function then?  Cool.

Right on.

> As far as authentication... cookies are optional.  But we are using httpauth in
> order to have session level authentication.  I want someone to come up with a
> way to do this in php so an auth doesn't take TWO connections to the DB, as now
> it requires one php and one mod_perl.

Yes, http authentication is easy in PHP.  Actually I thought we *were*
doing it that way...  are we not?

> What we are making optional with cookies (and thus you should account for on
> signup) is:  if the user chooses to accept an account cookie - they won't have
> to login every time they return to the site to restore there preferences.

Actually (correct me if I'm wrong) I don't think it's possible to mix
cookies and HTTP authentication!  They can't be mixed, at least not
trivially.  I guess we can check if they have the cookie, and if not
check HTTP auth.

> At any rate - my point is - this should be disabled for users with advanced
> privleges.  People with admin access to branches of the tree should not be
> allowed to store auth cookies methinks.  Someone finds out, walks up to there
> browser, and voila - hoses our tree.

Actually (again correct me if I'm wrong) that's a problem with HTTP
auth.  Once you're authenticated on a server, the login is valid until
you close the browser!  Is there a way to erase the login info without
closing the browser?  If so, I'd *really* like to know about it.

Later,
Micah