ErrorDocument 401 doesnt allow css links?

when i try to import a stylesheed with my 401 page, it wont!

[RedScourge]

ok, all my other ErrorDocument pages work fine, but i cant use a stylesheet in my 401 page for some reason, dunno why. i can use html tags and entries in the body tag just fine, but the stylesheet just wont work.

is there some option i can add somewhere to change this? i didnt mess with anything that i know of that would cause this behaviour.

running Apache 1.3.3x or something about there, its less than a month old version anyways.

[jdMorgan]

You'd need to remove any authorization requirements on the CSS file and on any other elements (images, external JS, etc.) the 401 page includes. Otherwise, attempts to access them in a currently-unauthorized state will simply result in another call for authorization, which would lead to recursion. Apache prevents that, but it hides this problem by doing so.

Downside: The fix exposes your stylesheet to unauthorized access.

Also, consider this: How important is it that your custom error pages be styled? One school of design would say that if you already have an error, you do not want to introduce further dependencies and complications into the problem. I tend to think that way, and all of my custom error pages are "styled" with plain-old <font> tags and devoid of any images or other external dependencies in order to avoid this very problem. I keep my error-handlers dirt-simple and very short so that they are less likely to fail and further complicate the problem that invoked them.

Imagine the scenario where you mis-type the filename of a new, updated stylesheet on the server. So, that file goes 404-Not Found when requested by your pages. But if the 404 Error Document page also includes that stylesheet, then the 404 error page itself will cause a 404, and that's a real recursive mess.

One other approach that might work, but I haven't tried it: Instead of using an "HTML include" of <style type="text/css">@import url(mysite.css);</style>, you could use <style></style> tags around a direct SSI-include of the external style sheet. This would make the style sheet look "internal" to the error page, and so not invoke an additional authorization session.

Me, I go for simple... :)

Jim

[RedScourge]

thanks, i was wondering about that, but the strange thing is that the css file isnt within any protected directories, its in the server root. ah well, using <style> or regular tags couldnt hurt on this one page i suppose.