The way HTTP works is that when you access a password protected document, the server responds with a 401 error. The client then has to make the request again with some headers set that contain the user name and password. Web browsers will cache this information (and modern ones will even remember it between sessions if you allow it) so you don't see the double request but you'll see it in the access logs.
When you access something that isn't protected, a 401 is never sent so your browser will never send that information.
Matt
-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of David Gibbs
Sent: Monday, August 11, 2008 1:05 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] User profile in secure pages (https)
Bradley V. Stone wrote:
For example, if you've set it up to protect /cgi-bin, that means that for
anything outside of that path the REMOTE_USER environment variable will not
be available.
Even if they are already authenticated?
I guess this makes sense ... if, after the user is authenticated, the users identity is still required, some kind of authentication token should probably be stored in a cookie or session identifier.
david
--
IBM i on Power - For when you can't afford to be out of business
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
http://archive.midrange.com/web400.
midrange.com
