mod_auth_mysql and mod_auth_cookie

Discussion in 'Apache' started by Hertzman, Jul 16, 2008.

  1. #1
    Hi!

    I have stumbled on an annoying problem and I can't find a sollution.

    I am working on a project which will include several pages, files and users and therefore I took the decision to use Basic Authentication.
    Since the users and the passwords are kept in a MYSQL database I am using mod_auth_mysql. So far so good.

    But I want the user to be able to login and logout through a custom login script. Now in the .htaccess-file you can choose what kind of encryption should be used with the cookie, and since the passwords in the MYSQL-database are md5-hashed the password in the cookie should be md5-hashed to.

    But if I change the encryption setting to 'md5' I can't login the standard way (via the popup) and I wan't to be able to do this.

    If I change encryption to 'none' the password in the cookie have to appear in clear text which I think is a great security risk.

    I thought I should provide an example to clarify everything:

    When AuthMySQLPwEncryption is set to 'md5' the cookie authentication works, but I can't login through the standard popup.

    When AuthMySQLPwEncryption is set to 'none' the cookie authentication doesn't work (unless I store the password in plain text in the cookie) but the standard popup works.

    I realize that the encryption setting in the cookie module affects the authentication generally but I still wonder if anyone can find a sollution to this tricky problem.

    Thanks in advance / Michael
     
    Hertzman, Jul 16, 2008 IP