Apache-AuthCookie logout issue

[Visitor]

I'm using Apache-AuthCookie for authentication. When I access a protected document, i get a login screen which does proper authentication. But when I click on logout, I expect it to delete the session cookie it set. So when I login again, I expect it to ask me for username/password but it allows me access to the protected document.
Please let me know if there's anything I'm missing in the logout process. I'd appreciate any help on this matter.

 

[fluid11]

"Apache::AuthCookie allows you to intercept a user's first unauthenticated access to a protected document. The user will be presented with a custom form where they can enter authentication credentials. The credentials are posted to the server where AuthCookie verifies them and returns a session key.

The session key is returned to the user's browser as a cookie. As a cookie, the browser will pass the session key on every **subsequent accesses**. AuthCookie will verify the session key and re-authenticate the user."

----> Thats what its supposed to do.


Try this instead...



Creating a “members-only” section of your website...
- we will create a membersonly folder within the DocumentRoot à /

http://www/domain/htdocs/membersonly

and give the Apache user and group access to it
- modify the httpd.conf file to create a new alias called /membersonly/…

Alias /membersonly/ “/

http://www/domain/htdocs/membersonly/”

- add the following directives to httpd.conf…

<Location /membersonly/>
AuthName “Members-Only Access”
AuthType Basic
AuthUserFile /

http://www/secrets/.members

require valid-user
</Location>

- AuthName creates a label that is displayed by the web browsers to the users. AuthType is always set to Basic because HTTP only supports Basic authentication by default.
- use the htpasswd utility to create the password file as below. The -c option is used to create the file and should be used just once. Make sure that only the Apache user can view the contents of this file and that the permissions on the file are 750.

/usr/local/apache/bin/htpasswd -c /

http://www/secrets/.members

chris

- use the htpasswd utility (without the -c) to create additional users afterwards



Let us know if that works out any better for you.



ChrisP

------------------------------------------------------------------------------
If somebody helps you, please vote for them for &quot;Tipmaster of the Week&quot; by giving them a &quot;purple star&quot;. This can be done by clicking the &quot;Mark this post as a helpful/expert post&quot; button.