Apache HTTP authentication

[craigbrass]

The ability to authenticate through HTTP Auth on Apache 2 without the need to modify standard settings.

[Jamie Edwards]

Originally Posted by craigbrass

The ability to authenticate through HTTP Auth on Apache 2 without the need to modify standard settings.

Well, this would be a feature request for Apache..

Originally Posted by Jamie Edwards

By default, Apache 2 does not allow you to authenticate this way (although Apache 1 does). mod_auth needs be configured correctly to allow for this (mod_auth - Apache HTTP Server).

[craigbrass]

Jamie: Your totally missing the point. Apache 2 allows you to authenticate, just not using the usernameassword method in the URL.

The WinApp could however authenticate the standard way if a way to do so was coded into it.

[Jamie Edwards]

Apache 2 will allow you to authenticate with mod_auth configured, yes. Apache 1 will allow you to authenticate without any authentication.

Either way, the Winapp supports HTTP authentication.

[craigbrass]

But without special configuration of Apache 2, you are still able to go to a password protected directory and get prompted to enter the details. All this special configuration does is allow you to use username : password in the URL. So, I am suggesting a way of the WinApp authenticating without username : password in the URL (ie another way that requires no special configuration).

[Roger Clark]

Craig, I am not sure what you're asking for here. You may need to clarify.

It sounds like you want to authenticate with a username and password without entering them into the URL box in the Account Options. If this is the case, the only difference would be that you would be entering the username and password into separate text boxes rather than in the URL. It would still work the exact same way.

If this is not the case, please explain further.

[craigbrass]

Apache 2 does not allow you to use username and password in the URL by default. Therefore, a way to do it directly rather than the URL is needed.

[Roger Clark]

Originally Posted by craigbrass

Apache 2 does not allow you to use username and password in the URL by default. Therefore, a way to do it directly rather than the URL is needed.

Apache 2 never gets the URL. The only thing the server gets is the actual file you're requesting and the query on it.

When you 'go' to a URL, the HTTP client connects to the hostname on the specified port, sends the username and password *separately* in the headers, then issues a POST or GET on the file and query string. The server never sees the URL.

You might be thinking of browsers that cracked down on the practice of putting auth credentials in the URL. This was because of phishing and other security issues. There is no such risk when specifying your URL in LiveResponse, so there's no reason to change it so that they have to specify the credentials separately. People will rarely need this option, but it's there for people who do end up needing it.