| Subject: | Auth::Simple::Apache doesn't call note_basic_auth_failure on auth failure |
If the Auth::Simple-based handler rejects the username and password,
Auth::Simple::Apache::handle returns HTTP_UNAUTHORIZED without calling
$r->note_basic_auth_failure. The result is that the browser won't
prompt for the password again until it is restarted or its credential
cache is cleared, which is annoying.
Patch attached, which works for me.
| Subject: | authen-simple-apache-notefailure.patch |
--- Apache.pm~ 2006-01-13 15:19:55.000000000 -0500
+++ Apache.pm 2007-04-17 23:24:31.000000000 -0400
@@ -17,7 +17,7 @@
eval "require $class";
}
- my @import = qw( OK HTTP_UNAUTHORIZED SERVER_ERROR );
+ my @import = qw( OK HTTP_UNAUTHORIZED AUTH_REQUIRED SERVER_ERROR );
if ( $mod_perl::VERSION >= 1.999022 ) { # mod_perl 2.0.0 RC5
require Apache2::RequestRec;
@@ -95,7 +95,6 @@
$r->log->error( "PerlAuthenHandler $class - Required parameter '$config' is not set." );
return SERVER_ERROR;
}
-
$params{ $option } = $value if defined($value);
}
@@ -114,8 +113,11 @@
$r->log->error( "PerlAuthenHandler $class - Couldn't authenticate. Reason: '$@'" );
return SERVER_ERROR;
}
-
- return ( $success ) ? OK : HTTP_UNAUTHORIZED;
+ if (!$success) {
+ $r->note_basic_auth_failure();
+ return AUTH_REQUIRED;
+ }
+ return OK;
}
1;