On 14 Sep 2011, at 21:36, Richard Hipp wrote: > > > On Wed, Sep 14, 2011 at 4:30 PM, Joshua Paine <[email protected]> wrote: > On 9/14/2011 4:22 PM, Ben Summers wrote: >>> HTTP basic authentication is widely supported in HTTP client >>> libraries, and much less hassle to use than passing tokens around. >>> >> The three major downsides with HTTP Basic Auth are: >> >> 1) No pretty login page >> 2) No reliable way to logout in most browsers >> 3) Requires sending the username and password over the wire >> >> 1 and 2 are irrelevant for a JSON API, and fossil's web ui already sends the >> username and password in the clear over the wire unless you're using HTTPS, >> so this is no greater risk, and it inherits the protection that an HTTPS >> setup provides. >> >> I vote for HTTP Basic Auth, provided that someone can confirm the major >> browser AJAX functions support it. >> > Note that Basic Auth is normally handled by the web server, not the client > application. The web server checks the credentials and then sets the > REMOTE_USER environment variable. Fossil honors the REMOTE_USER environment > variable in CGI mode, so you can use Fossil with Basic Auth. But, it comes > with all the downsides listed above, plus it means that the Admin/User page > will no longer work for setting and changing passwords since the passwords > are now stored in the web server, not in Fossil.
I believe that if you don't ask the web server to handle it, it'll just pass on the raw headers to the CGI script. Apache certainly works that way with proxying. > > One other thing: I don't think Basic Auth allows anything equivalent to the > current "nobody" user or the "anonymous" user. If you don't have a valid > login and password you cannot see anything at all. That would be downside > #5, if I'm counting right.... It's probably best implemented without enforcing the use of basic auth. So if the headers aren't present, don't return a 401, just do everything as now. You then get the best of both worlds, tokens or cookies and the option to use basic auth when it's the easiest mechanism available. Ben -- http://bens.me.uk/ _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
