On Tue, Mar 8, 2011 at 2:29 PM, Ron Wilson <[email protected]> wrote: > I think the best way is to set up Fossil to run as a CGI under a > webserver and let the webserver take care of authentication of user > ids. If you do this, you should set up the webserver to require HTTPS > seesions because even HTTP Hash Authentication is weakly secure.
The only problem with this is that an HTTP client will implement internal session handling inconsistently from another HTTP client. The implication of this is that, while you can log in using basic or digest HTTP authentication -- whether over SSL or otherwise -- you lack the ability to log out. That's just as much a security point in itself as the method by which information is transmitted between two parties. _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
