Question on how HTTP Auth works?

Worker Joined: Aug 06, 2004 Posts: 192

I have a question on how http auth actually works. I was testing something out and placed a phpinfo() file on my site to check to see what version of GD I had. To my suprise I saw my http auth username and password was listed with the rest on my phpinfo.

I then looked at one of the tables sentinel creates and the http auth username and password are stored there as well. In that table the password is stored three different ways plaintext, md5 and crypt. Isn't it bad that the password is stored unprotect in the db?

I guess my other question is exactly how does it work?

Posted: Fri Oct 29, 2004 1:30 pm

From what I understand, HTTP Authentication works outside of PHP Nuke. If will force an authentication at the server level before access to the admin.php is allowed, which then requires it's own authentication thru PHP Nuke.

Posted: Sat Oct 30, 2004 11:52 pm

So the only reason its stored in the DB is so you can easily change it?

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

No. That is a caveat. It has to be stored in order to compare it to the browser auth window when you are promted to input the user an password, just like the nuke login screen.