Strange htaccess problem

Custom error pages.

[Blackcat_UK]

Hi,

I've scoured Google and various forums for the last couple of hours, but can't find an answer to this one.

I've a small htaccess protected area on my site and I've used a script to pass the login details to the htaccess file. It works ok without problems.

If a wrong username/password is entered, then the usual pop-up login box appears for the user to re-enter the details. To stop this, I've set up a custom error message that basically is just a copy of the login page, with an Invalid message on it.

The problem is that if an invalid username and/or password is entered then the pop-up login box is still appearing over a blank page (the URL to the login script is shown on the address bar).

If a wrong entry is again made, then the custom error page is shown properly, and subsequently from then on. The error logs are showing nothing other than the usual fact that an invalid username or password has been entered.

I'll give any specific details on the script and htaccess contents if anyone shows any interest ;-)

[dmorison]

Hi again Blackcat!

A browser does not know that a username / password is required until it receives the Error Code 401 (Authorization Required) in response to a GET attempt....

So the browser infact receives your customised error page straight away - even before the user has had a chance to enter their username and password. Because it wouldn't look very good if this is what the users sees, browsers will not actually display the 401 document until they've let the user have a number of attempts at getting their username and password correct.

[Blackcat_UK]

Thanks for taking the time to reply.

Can I just illustrate this in baby steps, for my sake :-/

The user enters the main site index page:

www.mysite.com/index.html

and selects the login page link

www.mysite.com/html/login.html

the web-based login form is displayed and they enter a wrong username/password which is passed to the login script to redirect to .htaccess

www.mysite.com/html/loginscript.php

.htaccess rejects it and the server issues a 401 unauthorised error

I would expect here to see my custom 401 error page, but instead get a pop-up login box. If this is filled in correctly, then everything proceeds as normal, but if it's incorrectly filled in then I see my custom error 401 page. I then see my custom page at every subsequent wrong entry from then, or the normal protected page if the correct information is entered.

I don't understand why that first 401 error results in a pop-up login box, rather than my custom page which is defined in .htaccess?

Sorry if I appear a bit stupid here, but I've been chasing this problem for the best part of a day now :-/

[dmorison]

Hi Blackcat,

I think I see what you're doing now - and I think this problem and that you describe in your other post are related.

So you are providing your own login form in HTML, something like...

<form action="login.html">
<input type='text' name='username'>
<input type='password' name='password'>
<input type='submit'>
</form>

...kind of thing.

Then you redirect by sending the browser a 302 (redirection) to your protected page by redirecting to:

[username:[e-mail]...]

Ok:

1) If username and password are wrong, your server will send 401 Authorisation Required. Because this is the _first time_ the browser has seen this error for that page it will then offer the user the chance to enter a username and password - but this time of course using the browsers built in login dialog box and not your HTML form.

So i'm afraid using your current mechanism combined with the way "401 Authorisation Required" and browsers work together, you will not be able to get your custome error page displayed after the first incorrect attempt - because the browser won't display it until the user has had a few attempts.

Anyway,

2) This I think also explains the other problem you are having. Because you have sent the browser a redirect to the protected area by including the credentials within the URL, the browser has picked this up as the "BASE URL" (against which it references your relative links) and therefore displays the credentials in the status bar.

Hope this helps!

[Blackcat_UK]

This is the script (I found it on the web after much searching).

$server = "www.mysite.com/html/myprotectedarea/";

if(isset($HTTP_POST_VARS['username']))
{
$username = $HTTP_POST_VARS['username'];
}

if(isset($HTTP_POST_VARS['password']))
{
$password = $HTTP_POST_VARS['password'];
}

?>
<script>
function redirect()
{
window.location.replace("http://<?=$username?>:<?=$password?>@<?=$server?>");
}
setTimeout("redirect();", 500);
</script>

Grrrrr...I guess I'll have to look at some other method then...

Thanks very much for your help dmorison - I appreciate it :-)