I wouldn't use it, except as a quick and dirty solution (for example while the site is in development).
Some drawbacks I can think of: - Users of your app need to be actual users on your server -- unless you only have one password for everyone - Password is sent in cleartext for every request (unless you use https) - Ugly modal login box - Password is visible on the screen if someone uses the http://user:[EMAIL PROTECTED]/ format You could look at <cflogin> if you don't want to spend too much time with the authentication... Cheers, Vik > This is a multi-part message in MIME format. > > ------=_NextPart_000_0003_01C2D8D9.8DD562F0 > Content-Type: text/plain; > charset="us-ascii" > Content-Transfer-Encoding: 7bit > > Just flipping this one back to the group. > > Has anyone tried this technique and gotten it to work? > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of Blake > Foss - Web Foot Forward > Sent: Monday, 17 February 2003 12:02 AM > To: CFAussie Mailing List > Subject: [cfaussie] WWW-Authentication > > > Hi All, > > Has anyone ever used the WWW-Authenticate 401 method to password protect > a site? > > I want to add a quick login within a staging site I am working on and > instead of building a login form as per the norm I want the browser to > pop up the username and password window like the windows basic > authentication. > > The code I am using is below, > > <cflogin> > <cfif isDefined( "cflogin" )> > <cfif cflogin.name EQ "myusername" and cflogin.password EQ > "mypassword"> > <cfset roles = "user"> > </cfif> > </cfif> > > <cfif isDefined( "roles" )> > <cfloginuser name="#cflogin.name#" password="#cflogin.password#" > roles="#roles#"> > <cfelse> > <cfsetting enablecfoutputonly="yes" showdebugoutput="no"> > <cfheader statuscode="401"> > <cfheader name="WWW-Authenticate" value="Basic realm=""MySecurity"""> > <cfoutput>Not authorised</cfoutput> > <cfabort> > </cfif> > </cflogin> > > When I activate it on the server I get the pop up window asking for the > username, password AND domain. I enter the username and password, > correctly as embedded in the page and the thing just pops up the window > again. I keep entering the username and password and it keeps happening. > Now the server has locked me out. Oops! > > Has anyone used this type of authentication with CF? If I can get it to > work I will tie it into the database and do it properly. For some reason > I just like the little pop up window and thought it would save some time > over coding a form page as it will be removed when the site goes live. > Looks like a blew that theory, I think I have spent more time figuring > out this problem than doing it the way I know and have done before. > > Thanks in advance, > > Blake Foss > > ------------------------------------------------------------------------ > ----------- > Blake Foss > Web Foot Forward > p: 61 2 9340 4401 > f: 61 2 8080 8190 > m: 0410 747 620 > e: [EMAIL PROTECTED] > > --- > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] > To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > ------=_NextPart_000_0003_01C2D8D9.8DD562F0 > Content-Type: text/html; > charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> > <HTML><HEAD> > <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = > charset=3Dus-ascii"> > <TITLE>Message</TITLE> > > <META content=3D"MSHTML 6.00.2800.1141" name=3DGENERATOR></HEAD> > <BODY> > <DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN = > class=3D043041301-20022003>Just=20 > flipping this one back to the group. </SPAN></FONT></DIV> > <DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20 > class=3D043041301-20022003></SPAN></FONT> </DIV> > <DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN = > class=3D043041301-20022003>Has=20 > anyone tried this technique and gotten it to work?</SPAN></FONT></DIV> > <DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20 > class=3D043041301-20022003></SPAN></FONT> </DIV> > <DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20 > class=3D043041301-20022003></SPAN></FONT> </DIV> > <DIV></DIV> > <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = > align=3Dleft><FONT face=3DTahoma=20 > size=3D2>-----Original Message-----<BR><B>From:</B>=20 > [EMAIL PROTECTED]=20 > [mailto:[EMAIL PROTECTED]] <B>On Behalf Of = > </B>Blake Foss=20 > - Web Foot Forward<BR><B>Sent:</B> Monday, 17 February 2003 12:02=20 > AM<BR><B>To:</B> CFAussie Mailing List<BR><B>Subject:</B> [cfaussie]=20 > WWW-Authentication<BR><BR></FONT></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>Hi=20 > All,</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>Has = > anyone ever used=20 > the WWW-Authenticate 401 method to password protect a = > site?</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>I want = > to add a=20 > quick login within a staging site I am working on and instead of = > building a=20 > login form as per the norm I want the browser to pop up the username and = > > password window like the windows basic = > authentication.</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>The = > code I am using=20 > is below,</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial color=3D#ff0000 = > > size=3D2> <cflogin><BR> <cfif isDefined( "cflogin"=20 > )><BR> <cfif cflogin.name EQ "myusername" and = > cflogin.password=20 > EQ "mypassword"><BR> <cfset roles =3D=20 > "user"><BR> </cfif><BR> </cfif><BR> <= > BR> <cfif=20 > isDefined( "roles" )><BR> <cfloginuser = > name=3D"#cflogin.name#"=20 > password=3D"#cflogin.password#"=20 > roles=3D"#roles#"><BR> <cfelse><BR> <cfsettin= > g=20 > enablecfoutputonly=3D"yes" = > showdebugoutput=3D"no"><BR> <cfheader=20 > statuscode=3D"401"><BR> <cfheader = > name=3D"WWW-Authenticate"=20 > value=3D"Basic = > realm=3D""MySecurity"""><BR> <cfoutput>Not=20 > authorised</cfoutput><BR> <cfabort><BR> </= > cfif><BR> </cflogin></FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial color=3D#ff0000 = > > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>When I = > activate it=20 > on the server I get the pop up window asking for the username, password = > AND=20 > domain. I enter the username and password, correctly as embedded in the = > page and=20 > the thing just pops up the window again. I keep entering the username = > and=20 > password and it keeps happening. Now the server has locked me out.=20 > Oops!</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>Has = > anyone used this=20 > type of authentication with CF? If I can get it to work I will tie it = > into the=20 > database and do it properly. For some reason I just like the little pop = > up=20 > window and thought it would save some time over coding a form page as it = > will be=20 > removed when the site goes live. Looks like a blew that theory, I think = > I have=20 > spent more time figuring out this problem than doing it the way I know = > and have=20 > done before. </FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>Thanks = > in=20 > advance,</FONT></SPAN></DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial=20 > size=3D2></FONT></SPAN> </DIV> > <DIV><SPAN class=3D675085512-16022003><FONT face=3DArial size=3D2>Blake=20 > Foss</FONT></SPAN></DIV> > <DIV> </DIV> > <DIV align=3Dleft><FONT face=3DArial=20 > size=3D2>----------------------------------------------------------------= > -------------------</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>Blake Foss</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>Web Foot = > Forward</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>p: 61 2 9340 = > 4401</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>f: 61 2 8080 = > 8190</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>m: 0410 747 = > 620</FONT></DIV> > <DIV align=3Dleft><FONT face=3DArial size=3D2>e: <A=20 > href=3D"mailto:[EMAIL PROTECTED]";>[EMAIL PROTECTED]</A></FONT></DIV= > > > <DIV> </DIV>---<BR>You are currently subscribed to cfaussie as:=20 > [EMAIL PROTECTED]<BR>To unsubscribe send a blank email to=20 > [EMAIL PROTECTED]<BR><BR>MX Downunder AsiaPac = > DevCon -=20 > http://mxdu.com/ ---<BR> You are currently subscribed to cfaussie as: [email protected]<BR> To unsubscribe send a blank email to [EMAIL PROTECTED]<BR> <BR> MX Downunder AsiaPac DevCon - http://mxdu.com/ </BODY></HTML> > > ------=_NextPart_000_0003_01C2D8D9.8DD562F0--
