3 ms·
I use HTTP authentication when I want to password protect a bunch of static files, or a third party web app. Using the PAM auth module with Apache is particular
by mike-cardwell 16y ago
I use HTTP authentication when I want to password protect a bunch of static files, or a third party web app. Using the PAM auth module with Apache is particularly nice. Just drop a few lines in a .htaccess file and it uses your users system credentials, eg /etc/passwd and /etc/shadow.
HTTP Authentication comes in several flavours. I've not done it myself, but I think you can do interesting things to with Kerberos. Good for Intranet systems.
HTTP Authentication does have its places.
- tptacek 16y agoIn other words, HTTP Authentication is useful in the same sense as FTP is useful: it's outmoded but sometimes convenient.
- mike-cardwell 16y agoHTTP Authentication is sessionless. In any scenario where you want to protect something without establishing and maintaining a session, it's useful. The only large public website that I know of which still uses HTTP Authentication though is http://www.123-reg.co.uk/ http://www.123-reg.co.uk/
- tptacek 16y agoWhat's the browser app scenario in which having a session is a liability, but having a stored HTTP Auth credential isn't?
- kls 16y agoActually the elimination of server side session reduces distributed application topology significantly. It is far easier to scale a stateless app than it is a statefull app.
- deleted 16y ago[deleted]