Re: Status & CVS & objects

[Micah K Yoder <LYoder@cyberis.net>]

Jason Pincin wrote:
> 
> We obviously have a lot to talk about regarding authentication.

Never mind.  The way we're doing it is OK.

> No one seems to be agreeing.  We could just ditch http_auth altogether and
> go back to some kinda custom auth scheme...

HTTP auth is better - I was just pointing out a possible disadvantage. 
Users *will* have to close their browser to erase the login info, as
Daniel pointed out.

The way we do it at work *does* allow for a "logout" command that will
destroy that info until they log out again.  But that's what requires a
cookie.

> I don't know enuf about http_auth to talk about it much.  I need to school
> myself or have someone explain it all to me before I say much more...

Basically, the first time you take your browser to a page in a "domain"
that requests an authentication, it will give you the username/password
box.  EACH additional time that domain is requested (from the same
server) it will automatically send the same username/password pair.  It
will continue to do that until you close your browser.  There's no way
to change your login info, or erase it, except to close and restart the
browser.  Kinda sucks, but unless we use cookies or another form
variable EVERY time someone goes ANYWHERE on the site, that's what we're
stuck with.

actually that's not 100% correct...  I did just think of a way to do a
logoff...  if they click a logoff button, it can just send the browser
an authentication error.  You'll then get that username/password box
again though... but if you hit Esc, you'll be out of it and your login
info won't be there anymore.