News for hackers. Stuff that matters.

Simple Apache Form Authentication: mod_auth_cookie

This module seems to have fallen by the wayside: The previous homepage has gone dark, and I was luckily able to grab the source from archive.org.

It's a really great way to set up a simple login form and get rid of the ugly Basic Authentication prompt. You still use Basic Authentication (including a .htpasswd file or mod_auth_mysql, for example), but redirect using a custom 401 handler that shows a login form, that in turn sets the user:password combination as a cookie.

On the server, mod_auth_cookie then takes that cookie and fakes the Basic Authentication headers. It's literally so simple, it can be configured with one line on top of Basic Auth:

AuthCookieName CookieName

I've resurrected the module from the abyss, and hosted a shiny new homepage at http://modauthcookie.weebly.com/

( 4 comments | 7 points | on HN )
Re:Simple Apache Form Authentication: mod_auth_cookie by xefyr on Wednesday February 20, 2008 @01:20PM (#119845)
For the curious, I've had the recent misfortune of working with JBOSS at work; this sounds identical to how it provides form-based authentication.

For the curious: http://wiki.jboss.org/wiki/Wiki.jsp?page=SecureAWebApplicati...

Re:Simple Apache Form Authentication: mod_auth_cookie by a_caspis on Wednesday February 20, 2008 @07:38AM (#119622)
Did it fall out of grace because it was vulnerable to cross-site attacks ? ( http://en.wikipedia.org/wiki/Cross-site_request_forgery )
Re:Simple Apache Form Authentication: mod_auth_cookie by drusenko on Wednesday February 20, 2008 @09:01AM (#119669)
i believe it fell out of grace because the maintainer's page disappeared. and no, it shouldn't be any more vulnerable to CSRF than a simple session-cookie system, which is what this basically is.
Re:Simple Apache Form Authentication: mod_auth_cookie by brk on Wednesday February 20, 2008 @06:42AM (#119608)
Very cool, I will probably use this at some point soon.

IMO, this is a big part of what makes open source so valuable.