Re: Clearing user names and passwords

Even so, you'll have to do the signon/persitent programming
manually either passing hidden fields in every screen or
using cookies.  

You'll still have the problem of not being able to force a
user off with cookies because you can't force them to take
a logoff option which would expire the cookie, and the
cookie would still be good for the browser's life (until
they close).  Unless you code to expire the cookie in "X"
minutes/hours, etc... but the problem would still be there
for a certain window.

Trying to track if they leave your site is a royal pain
that won't work that well either.

I'd say stick with what you have, and if they don't close
the session it's their own fault (of course, you have to
explain that to them in the logon screen). 

And you're not using SSL, it's called Basic Authentication
as someone else pointed out.. just so you know.  :)
Just like when I signon to my bank's website, I have to
remember to log off, espeicially at a public terminal.

On Thu, 12 Feb 2004 13:33:11 -0500
 "Chris Piper" <Cpiper@xxxxxxxxxxxx> wrote:
> The other problem I have, it is I.E. on the Windows
> Pocket PC OS, on an Intermec bar code gun. I have coded a
> close in Javascript, which works for normal PC based
> browser's but doesn't do anything on the Pocket PC
> browser. So I am thinking of just setting up a page to
> get the user id, and password from the user, then passing
> it over to a API to determine if they are correct.
> Problem I am having with that, is I can't find a API that
> allows me to pass un-encrypted passwords, and verify
> them. Any ideas?
> 
> >>> WaldenL@xxxxxxxxxxxxxxx 02/12/04 12:24PM >>>
> I assume you're speaking of basic authentication (where
> you get the dialog
> box from the browser to enter the user/password.)
> 
> In this case the user and password is resent on every
> request, so the
> browser (IE, or any other) has to remember them so it can
> send them each
> time.
> 
> Your choices are with that authentication scheme are:
> 1) Tell the user to Close the browser! 
> 2) Install some JS hook so pick up when you're leaving
> the site and close
> the browser on them. 
> 
> Either is ugly.
> 
> You could move to a database-driven authentication scheme
> (ala, ebay,
> amazon, etc.) then timeout the session, but that's a
> major code change.
> 
> -Walden
> 
> 
> ------------
> Walden H Leverich III
> President & CEO
> Tech Software
> (516) 627-3800 x11
> (208) 692-3308 eFax
> WaldenL@xxxxxxxxxxxxxxx 
> http://www.TechSoftInc.com 
> 
> Quiquid latine dictum sit altum viditur.
> (Whatever is said in Latin seems profound.)
>  
> -----Original Message-----
> From: Chris Piper [mailto:Cpiper@xxxxxxxxxxxx] 
> Sent: Thursday, February 12, 2004 10:34 AM
> To: web400@xxxxxxxxxxxx 
> Subject: [WEB400] Clearing user names and passwords
> 
> I am using SSL security on a test web site. User logs in
> with name and
> password, uses the site, and then leaves the site. If the
> user doesn't close
> I.E., he or she can access the site again without having
> to enter their user
> name and password again. The problem I have is the PC in
> question my be a
> community PC, with multiple users, and I don't want
> anyone getting access to
> the site under someone else's user name, and I can't
> figure out how to force
> the browser to "forget" the user name and password. Can
> any help me out?
> Thanks so much.
> 
> Chris
> 
> 
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400)
> mailing list
> To post a message email: WEB400@xxxxxxxxxxxx 
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400 
> or email: WEB400-request@xxxxxxxxxxxx 
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/web400.
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400)
> mailing list
> To post a message email: WEB400@xxxxxxxxxxxx 
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400 
> or email: WEB400-request@xxxxxxxxxxxx 
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/web400.
> 
> 
> 
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400)
> mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/web400.
> 

Bradley V. Stone
BVS.Tools
www.bvstools.com