.htaccess admin authentication?

[diixo]

is there any established way to authenticate admin users through htaccess instead of the login form?

i could just comment out the authentication piece, but i'm concerned that this will break other things.

[yellow1912]

Why? htaccess can be used along with the login form, not to be used alone. It's NOT safe.

[diixo]

Why? htaccess can be used along with the login form, not to be used alone. It's NOT safe.

to tie in three different login systems without mucking in the database.

how is it less safe? the only downside that i'm aware of is a bad interface.

[yellow1912]

"[FONT=Verdana, Arial, Helvetica]The password is passed over the network not encrypted but not as plain text -- it is "uuencoded". Anyone watching packet traffic on the network will not see the password in the clear, but the password will be easily decoded by anyone who happens to catch the right network packet. [/FONT][FONT=Verdana, Arial, Helvetica]So basically this method of authentication is roughly as safe as telnet-style username and password security -- if you trust your machine to be on the Internet, open to attempts to telnet in by anyone who wants to try, then you have no reason not to trust this method also."


[/FONT]

[diixo]

thank you for that explanation.

what if i logged the user in over https and then forwarded the successful login to the regular http server? or not at all.

[yellow1912]

Let me get back to the original topic though: you probably have to edit part of the code to do what you want. I believe application_top.php will invoke the auth checking somewhere, probably using admin/includes/auto_loaders

Try to comment out the part that does the authentication to see if you can get in admin, and see if it breaks anything. If it break things, you will have to "fake" the authentication, set the session at the first time the user logins so the system will not ask for auth again.

Still, I see this as a potential security risk.