in reply to Accessing Authenticated User's Password From CGI

By design, the authenticated user is passed in the CGI environment, as you have found, but not the password.

If you need the password as well, you'll need to ask for it as part of the form.

BasicAuth is a hack anyway. You can't force a logout. You can't force a timed-out logout. You should be using a cookie-based login scheme, as I illustrated in one of my more famous columns.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.

  • Comment on •Re: Accessing Authenticated User's Password From CGI

Replies are listed 'Best First'.
Re: •Re: Accessing Authenticated User's Password From CGI
by Cody Pendant (Prior) on Feb 11, 2003 at 02:52 UTC
    I just went and read that famous column.

    The section

    The wrong way to use cookies, therefore, is to have a login form, and on successful login, send out a cookie that lasts until year 2003 to that browser. That's bad.

    Has a little less impact now that it is 2003.
    --

    “Every bit of code is either naturally related to the problem at hand, or else it's an accidental side effect of the fact that you happened to solve the problem using a digital computer.”
    M-J D
[reply]
Re: •Re: Accessing Authenticated User's Password From CGI
by enoch (Chaplain) on Feb 10, 2003 at 23:07 UTC
    Hmm... I suspected as much. Thanks for the reply; I am off to read up on Kerberos modules.

    enoch
[reply]

      i did this (authenticate via Kerberos using CGI) not too long ago. i couldn't find a Module that easily did exactly what i wanted. the closest was Authen::Krb5::Easy, but it used the /etc/krb5.keytab file instead of passwords to get a principal. so i hacked it to do what i wanted... just a change from calling krb5_get_init_creds_keytab to krb5_get_init_creds_password in the Easy.xs file and tweaking the arglist and documentation.

      WARNING: since i only used this module in one application (with it's own private /lib/perl) i didn't get around to renaming it to something like Authen::Krb5::Easy::Password or the like. should you use it, be warned... i wouldn't put it where another Perl user could use it thinking it was the real Authen::Krb5::Easy module...

      
# simple useage
use Authen::Krb5::Easy;

my ($user, $password) = @ARGV;
if ( Authen::Krb5::Easy::kinit( $user, $password ) ) {
  print "Authentication success!$/";
} else {
  print "Authentication failure!$/";
}

      [download]

      you can try it if you like ... Authen-Krb5-Easy-0.90-hacked.tgz

[reply]
[d/l]

In Section Seekers of Perl Wisdom