[KeyLimePi]

I'm working on a site with a directory that is protected with htaccess. I'd like to create a custom login page instead of relying on the browser default. Anyone have any experience with this?

I'm working in straight HTML and I've got a little scripted form that creates the 'http://user:pass@mysite.com/secure' link, but this won't work. Is this a limitation of htaccess or am I just doing something wrong?

Thanks.

[Millennium]

Originally posted by KeyLimePi:
I'm working on a site with a directory that is protected with htaccess. I'd like to create a custom login page instead of relying on the browser default. Anyone have any experience with this?

I'm working in straight HTML and I've got a little scripted form that creates the 'http://userass@mysite.com/secure' link, but this won't work. Is this a limitation of htaccess or am I just doing something wrong?

This is a limitation of Basic HTTP Authentication, I'm afraid. The only way around it is to use something else.

What is it about .htaccess that appeals? If you just want to be able to use the htpasswd file for your passwords, then you can cheat by using a login script which parses out the .htpasswd file as its user database but uses some other scheme as the actual authentication method. If you want to actually control access using Apache's configuration, however, you're pretty much out of luck. Similarly, if you can't use any server-side scripting then you're out of luck.

[nica]

What about making a logging page. Then have the user click the a button/link to log on that will take them to the protected directory and that will request the username/password. my 2c.

[KeyLimePi]

Well, thanks for the info. I'm using htaccess because 1) it's easy to manage with my host and 2) it's about all my limited skills can handle. I've got to learn some PHP one of these days.

And basically nica I'm doing just what you suggested. I have a login page with a link to the secure stuff, but I was hoping to have a form right on the page for the name/password.

At the company where I work your browser prompts you for your employee ID/password every time you try to access the web outside our intranet. This is no problem, but when employees hit other secure sites and get the same prompt, their first instinct is to enter their employee ID/password (I get a lot of calls about this). I just wanted to make my login look different that so it might elminate confusion.