Member Avatar for Acute

Hi everybody!
I have a problem here while using an http authentication:
when you open the page with http-auth code in the browser, the user-name and password box appears-it is Ok, however, I can't make the user-name&password box to apperar again....For example, if you login wrong user-name or pw you can't try again, you must close the browser and open it again to login.

I'm sure most of php programmers know what i mean=>help me!!!

  • 3 Contributors
  • 2 Replies
  • 124 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by jbennet

Dani AI

Generated

This is expected behavior for HTTP Basic authentication: the browser manages the login dialog and typically caches the credentials for the current realm and session, so it often will not show the prompt again after a failed try until the session is closed or the realm changes. For background on how the browser/server exchange works see MDN: HTTP authentication.

To force the browser to show the prompt again from PHP, respond with a 401 and include a WWW-Authenticate header. The usual pattern is to send the header and exit whenever credentials are missing or invalid. Example:

<?php
if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER'] !== 'expectedUser' || $_SERVER['PHP_AUTH_PW'] !== 'expectedPass') {
    header('WWW-Authenticate: Basic realm="Restricted Area"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Authentication required';
    exit;
}
// authenticated: continue

Note three practical points: (1) an HTML meta no-cache tag (the idea mentioned by ) will not reliably clear the browser auth cache because the prompt and credentials are handled at the HTTP layer before any HTML is processed; (2) some browsers suppress re-prompts when the user clicks Cancel — there is no cross-browser JavaScript method to clear the stored Authorization header, so testing in a private/incognito window or restarting the browser is the easiest immediate test; (3) if you need programmatic logout or finer control, switch to a form-based login with sessions/cookies instead of Basic Auth. For PHP-specific guidance see PHP: HTTP authentication.

When asking for help (as suggested), include the exact PHP code that checks PHP_AUTH_USER/PHP_AUTH_PW, the headers your script sends, and the browser + server (Apache/nginx) you tested with. That makes it much easier to pinpoint whether the server response is correct or the browser is caching credentials.

Recommended Answers

All 2 Replies

Member Avatar for humbug

You need to post the relevant code for anyone to know what's going on. Is the code that checks the input data and the code that displays the input boxes on the same page? Does refreshing/reloading the page allow you to retry?

Member Avatar for jbennet

<HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">

I think if you add that to the <head> it will work

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.