.htaccess and internet explorer

once login and pass ok, IE doesn't prompt anymore

[solito]

hello,

I added more users in the htpasswd on a site I m working on and wanted to check their access.
1st user : ok
2nd user :? IE doesn't prompt any dialog box and display the page?

I quit IE, i emptied cache, press shift-refresh,
even deleted all the temporary internet files in the windows\profile\user ,
checked for any name or pass in the registry...

but it doesn't change anything ! IE still displays the page without prompting anything ! wow ! that s seems hyper secure browser !

so if anyone knows that prob, how can i get IE to prompt a diag box each time i go in these restricted directories?

btw : on netscape it works very fine.
thx.

[jdMorgan]

Solito,

Welcome to WebmasterWorld!

What version of IE are you using? (Make sure it is not set up to "remember passwords"!)

Are there any caching proxies (ISP or corporate network) between you and the server that the site is hosted on?

JIm

[shady]

Even if it is set to remember passwords, it would normally prompt for it, with defaults in my experience.

Can you post the contents of .htaccess?

[Air]

What jdMorgan said.

In addition, IE will prompt for a password once per session. So close the browser (all instances) and open a new instance, it should then prompt for the password.

[bobriggs]

Air:

I quit IE, i emptied cache, press shift-refresh..

I've seen this before, and only on high-speed setups (cable/dsl, etc) and it's on a LAN (however I don't think that has anything to do with it)

In addition, it's only on a Windows platform.

So my thinking is that even if you don't have an IE browser there, there's still a session open (I don't know how). I agree that after each session the authentication should restart. So if this is happening, there is a session still around somewhere. Is this the MSIE integration into windows that Microsoft has argued in the courts? Is it Windows Explorer (not the IE explorer) acting as a web browser or as part of the web browser? Something to think about.

[shady]

In which case, have you rebooted?

[bobriggs]

Of course a reboot will clear any session (I think you're directing the question to me...)

My point is that even if the browser is closed, a session still exists sometimes.

Possibly from another application that is using the WinInet services (which is just using Internet explorer's services anyway). Example - That realaudio icon down in systray comes to mind. Or, as I mentioned, suppose windows explorer (not IE) is set to 'show web content on my desktop', etc. Is there still a session there or not?

[shady]

Hi bobriggs

Sorry, the question was directed to solito! I'm not sure whether the issue is programmer testing the passwords, or user security.

With regard to inet sessions, since downloading SP3 for win2000, I now find that there are often two sessions of IE running in the background when I try to shut down windows! In my configuration, I have no problem with username/passwords - these always clear after closing the associated IE session. But with all things windows, I guess it is rare that two people are running exactly the same config.!

[bobriggs]

Exactly, here's an opposite symptom:

[support.microsoft.com...]

So I'm wondering if solito might be running an old IE4 version, with the 'Browse in New Process' disabled. Since there was an authentication problem in MSIE way back when - In the opposite direction, and a temp fix was to uncheck 'browse in new process' (which I can't find any more - IE6), then there could have been reverse side effects - in other words, all authentication is common to all processes.

And then again, maybe it's just another IE bug that nobody's mentioned before. I can't find anything about the symptom on microsoft.com, but I can say that I have observed it before. And this was a while back - I have no recollection of the browser version.

What say you solito? Do you have a browser version?

[solito]

Thx very much for your replies,

my IE version is 5.50.xxxxxx

the content of htaccess is :
PerlSetVar AuthFile ulist/.htpasswd
AuthName "restricted area"
AuthType Basic
require valid-user

in ulist/.htpasswd there is a list of users

IE is configured to open a new browser each time
(I wanted to check that out but don t even remember where the settings are but i know this is the setting - i don t like loosing windows when opening new browser ;)

on the other hand, rebooting to check a password isn t the idea when working on a project...

[solito]

oops forgot to mention that I have a NT server at home which makes the connexion to internet on ADSL.

so my workstation (win 98) is configured on LAN connexion

the prob is on the 98

(server NT is just for connexion and some site tests - never work on it)

[solito]

No IE isn't set to remember passwords (well there again I don t see any of that in IE config - maybe it s too early in the morning...)

I always uncheck all these things that IE offers (I don t like this pseudo-friendly-user stuff of windows...)

even if it was checked, IE would prompt a diag box with login / pass pre-entered I think, wouldn't it?