Mod Auth has been set up and running fine for months. I have a number of directories requiring authentication to allow specific users only and all working OK.
I have just built some new web pages requiring authentication. It works fine, however I get extra pop up boxes asking for username and password for different directories. I have checked all the conf files and they definitely point to the correct directories. This problem only occurs on the new directories.
Interestingly if you just click cancel it then allows access.
More info: I removed authentication for the new directories to test. However I still get 2 pop up boxes asking for authentication for other directories that do have authentication. But if you click cancel it bypasses the authentication and gives you access.
I have checked all conf files and as I mentioned earlier, authentication works perfectly for other directories.
I am beginning to think it could be an Apache problem. Any ideas??
These popup boxes are created by the browser when the browser doesn't have valid credentials for the server.
When you try to access a protected resource on the server, the server will send a "401 Unauthorized" message back to the browser. The browser is then responsible for sending the userid/password to the system. If the user already has it cached (i.e. from a previous page this session), the browser will respond with that infomration.
However, if the browser doesn't have the info, or the server responds to the userid/password info with another 401, the browser will pop up a window asking for the correct userid/password.
The fact you're getting multiple boxes indicates the browser is receiveing multiple 401 errors. This is generally caused by a configuration error on the server (although it could be other things). What do you have for *all* of the parameters for one of the failing directories (please leave out userids/passwords)?
Found the problem....I use a template to dynamically build a html file from a unix shell script. The template was pointing to some images for backgrounds that were in protected directories. Hence the pop up boxes for those directories were asking for authentication. When i hit cancel on authorisation box the page still loaded minus the offending images. I moved the images folder to same directory as my html files and changed template accordingly.
All good now..lesson learnt.
I seem to be experiencing a similar problem with a page that makes a lot of AJAX calls. The page has a configurable "refresh timeout" and I can see it is prompting everytime this expires (causes refresh query back to server).
I think i'm going to write a quick bit of code to make simple calls to the server on a button click or something and see how my browsers react and whether or not they pop up user/pass prompts