PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

404 Chapter 17 Implementing Authentication with PHP and MySQL
tells Apache what document to display for visitors who fail to authenticate (HTTP error
number 401).You can use other ErrorDocument directives to provide your own pages
for other HTTP errors such as 404.The syntax is
ErrorDocument error_number URL
For a page to handle error 401, it is important that the URL given is publicly available.
It would not be very useful in providing a customized error page to tell people that their
authorization failed if the page is locked in a directory in which they need to successfully
authenticate to see.
The line
AuthUserFile /home/book/.htpass
tells Apache where to find the file that contains authorized users’ passwords.This file is
often named .htpass, but you can give it any name you prefer. It is not important what
you call this file, but it is important where you store it. It should not be stored within
the web tree—somewhere that people can download it via the web server.The sample
.htpass file is shown in Listing 17.8.
As well as specifying individual users who are authorized, it is possible to specify that
only authorized users who fall into specific groups may access resources.We chose not
to, so the line
AuthGroupFile /dev/null
sets the AuthGroupFile to point to /dev/null, a special file on Unix systems that is
guaranteed to be null.
Like the PHP example, to use HTTP authentication, you need to name the realm as
follows:
AuthName “Realm-Name”
You can choose any realm name you prefer, but bear in mind that the name will be
shown to your visitors.To make it obvious that the name in the example should be
changed, we named ours “Realm-Name”.
Because a number of different authentication methods are supported, you need to
specify which authentication method you are using. Here, you use Basic authentication,
as specified by this directive:
AuthType Basic
You also need to specify who is allowed access.You could specify particular users, particular
groups, or as we have done, simply allow any authenticated user access.The line
require valid-user
specifies that any valid user is to be allowed access.