Before returning AUTH_REQUIRED, you need to call $r->note_basic_auth_failure, otherwise the WWW-Authenticate HTTP header isn't returned, so the browser doesn't ask the user to re-enter their username and password.
Strictly speaking, you should return FORBIDDEN from a PerlAuthzHandler which is called after the PerlAuthenHandler. This gives you the flexibility to deal with authentication and authorisation in different stages. You can use $r->notes to pass variables between separate handlers.
If you want to give the user three chances only, you'd need to store some session data, possibly using Apache::Session. However, I can't see the advantage of this, as malicious clients will find some way of pretending to be someone else (User-Agent modification, dispose session cookies, etc.) then send three more requests.
In reply to Re: Apache AuthType problem
by tomhukins
in thread Apache AuthType problem
by Jonathan
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |