For all of you mod_perl types out there:

How difficult would it be to write a PerlAuthenHandler that takes the 401-prompted username/password pair, create a timestamp file, and for each time the user requests a page, check the timestamp. If the timestamp is ever more than 15 minutes old (or some other time, set by configuration), instead of sending the requested document, send a login script requesting password again, and if the password is correct in the cgi form, then return the requested document?

I know this is convoluted and I have most of the other part, I'm just not sure how to spawn a subrequest in mod_perl that is part of the PerlAuthenHandler Authentication phase. It shouldn't be too hard to force Apache to parse the user input from a cgi script as part of the Authentication phase, but I'm not adept at mod_perl enough to do it. Here is a nice little flow chart type thingy:

_401 response_  -> request username password -> check timestamp -> \

if timestamp is too long, or no timestamp -> return a cgi -> if user i
+nput \

checks out -> send the requested document.
[download]

Browsers are too flaky to rely on sending AUTH_REQUIRED to prompt a username/password entry.

Thanks,

jjhorner