#5 Triple HTTP Authentication

[Dobo Radichkov]

It is common on the WWW to popup the HTTP Auth
window 3 times before the "Login failed" is shown. This
would be nice to be somehow implemented in the
LoginHandler - something like a counter of unsuccessful
login attempts before one is sent to the fail action.

[Adam Franco]

Logged In: YES
user_id=789554

I haven't run into the problem that you encountered, but it
may be a browser issue.

Read the Apache documentation on HTTP Authorization for more
info:

http://httpd.apache.org/docs/howto/auth.html

When the server initiates an HTTP Auth request, via a 401
header, its then up to the browser to supply credentials or
cancel. There isn't any interaction with the server at this
point. Once credentials have been passed successfully,
browsers generally cache the credentials. From there, the
browser passes the cached credentials every time an HTTP
Auth header is recieved. The server has no control over the
caching of the credentials. As such, the only way to log out
is to initiate a new HTTP login request where the cached
credentials aren't good. Kinda problematic, but that's the
way it works.

The status of this feature request will remain pending until
it is clarified what is the new desired functionality.

[Dobo Radichkov]

Logged In: YES
user_id=789552

I don't understand why you removed this feature request. It
is not a "problem", or a bug - it is indeed simply a feature
request. What I meant is (and I am simply repeating my initial
description):

A lot of web based apps have the "die after three
unsuccessful logins" policy. See PHPMyAdmin for example, it
functions like that. It is very easy to do this using simple PHP
and HTTP headers. My proposal was to implement this with
the already existing HTTP Authentication in the
Authentication Handler (and why not with the other types of
authentication as well). In other words, if login is
unsuccessful, do not send the user to the fail action unless
they fail three times in a row (or 5 times, or 35 times - make
it customizable, thus the counter I suggested).