Authentication Protocol
Authentication is simple in principle. The client sends his name and password to Apache. Apache looks up its file of names and encrypted passwords to see whether the client is entitled to access. The webmaster can store a number of clients in a list — either as a simple text file or as a database — and thereby control access person by person.
It is also possible to group a number of people into named groups and
to give or deny access to these groups as a whole. So, throughout
this chapter, bill and ben
are in the group directors, and
daphne and sonia are in the
group cleaners. The webmaster can
require
user so and so or
require
group such and such, or even simply
require
that visitors be registered users. If you
have to deal with large numbers of people, it is obviously easier to
group them in this way. To make the demonstration simpler, the
password is always theft. Naturally, you would not use so short and
obvious a password in real life, or one so open to a dictionary
attack.
Each username/password pair is valid for a particular realm, which is named when the passwords are created. The browser asks for a URL; the server sends back “Authentication Required” (code 401) and the realm. If the browser already has a username/password for that realm, it sends the request again with the username/password. If not, it prompts the user, usually including the realm’s name in the prompt, and sends that.
Of course, all this is worryingly insecure since the password ...
Get Apache: The Definitive Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.