PHP MySQL - Stilson.net

CHAPTER 14• AUTHENTICATING YOUR USERSwww.it-ebooks.infoappropriate capabilities, including Internet Explorer, Netscape Navigator,Mozilla Firefox, and Opera.4. The user-supplied credentials (typically a username and password) are sentback to the server for validation. If the user supplies correct credentials, accessis granted; otherwise it’s denied.5. If the user is validated, the browser stores the authentication informationwithin its cache. This cache information remains within the browser until thecache is cleared, or until another 401 server response is sent to the browser.Figure 14-1. An authentication promptAlthough HTTP authentication effectively controls access to restricted resources, it does not securethe channel in which the authentication credentials travel. That is, it is possible for a well-positionedattacker to sniff, or monitor, all traffic taking place between a server and a client, and within this trafficare the unencrypted username and password. To eliminate the possibility of compromise through sucha method, you need to implement a secure communications channel, typically accomplished usingSecure Sockets Layer (SSL). SSL support is available for all mainstream web servers, including Apacheand Microsoft Internet Information Server (IIS).Using Apache’s .htaccess FeatureFor some time now, Apache has natively supported an authentication feature that is perfectly suitable ifyour needs are limited to simply providing blanket protection to an entire website or specific directory.In my experience, the typical usage is for preventing access to a restricted set of files or a project demo inconjunction with one username and password combination; however, it’s possible to integrate it withother advanced features such as the ability to manage multiple accounts within a MySQL database.You’ll take advantage of this feature by creating a file named .htaccess and storing it within thedirectory you’d like to protect. Therefore, if you’d like to restrict access to an entire website, place thisfile within your site’s root directory. In its simplest format, the .htaccess file’s contents look like this:AuthUserFile /path/to/.htpasswdAuthType BasicAuthName "My Files"Require valid-userReplace /path/to with the path that points to another requisite file named .htpasswd. This filecontains the username and password which the user must supply in order to access the restricted304