httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Marc Slemko <>
Subject Re: config/315: <LIMIT> causes two password queries unless given fqdn.
Date Sun, 06 Apr 1997 01:57:27 GMT
The answer to this (psst... another FAQ?) is probably that Apache is
issuing a redirect which causes it to be a different server as far as the
client knows, making it reprompt for the name.

If the directory /foo/ is protected, is there any reason why a request for
/foo needs to return a 401?  Would it cause a security hole if it just
returned the redirect to /foo/ without requiring authentication?  That
would eliminate this frequent problem; Netscape Commerce 1.1 avoids the
problem by doing things this way.

Don't have time to look at the code right now... 

On Fri, 4 Apr 1997, Joanna Gaski wrote:

> >Number:         315
> >Category:       config
> >Synopsis:       <LIMIT> causes two password queries unless given fqdn.
> >Confidential:   no
> >Severity:       non-critical
> >Priority:       medium
> >Responsible:    apache (Apache HTTP Project)
> >State:          open
> >Class:          sw-bug
> >Submitter-Id:   apache
> >Arrival-Date:   Fri Apr  4 12:20:02 1997
> >Originator:
> >Organization:
> apache
> >Release:        1.2b7
> >Environment:
> Digital Unix 4.0B, cc compiler
> >Description:
> This problem occurs when using the new "satisfy any" match ability for .htaccess
> files. Using this .htaccess file in /info/test:
> <Limit GET>
> satisfy any
> order deny,allow
> deny from all
> allow from
> Authname test
> AuthType Basic
> AuthUserFile /www/docs/info/test/passwd
> require valid-user 
> errordocument 403
> </Limit>
> When a request is made for the page from another domain, Netscape queries the
> user twice for their password, UNLESS the URL for the requested page contains
> the server's fully qualified domain name, with the domain in all caps. In this
> case, the user is only queried once. 
> >How-To-Repeat:
> No, because you aren't in our password file. It should be easy to recreate
> on another system.
> >Fix:
> It may be that the time it takes the webserver to qualify the domain name is
> causing the problem. Another clue would be that the two password validation
> boxes are different sizes, meaning that they are generated in different parts
> of the code. Sorry can't help more
> >Audit-Trail:
> >Unformatted:

View raw message