granicus.if.org Git - apache/blob - docs/manual/mod/mod_auth_form.html.en

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
   4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
   5 <!--
   6         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   7               This file is generated from xml source: DO NOT EDIT
   8         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   9       -->
  10 <title>mod_auth_form - Apache HTTP Server Version 2.5</title>
  11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
  12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
  13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
  14 <script src="../style/scripts/prettify.min.js" type="text/javascript">
  15 </script>
  16
  17 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
  18 <body>
  19 <div id="page-header">
  20 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
  21 <p class="apache">Apache HTTP Server Version 2.5</p>
  22 <img alt="" src="../images/feather.png" /></div>
  23 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
  24 <div id="path">
  25 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.5</a> &gt; <a href="./">Modules</a></div>
  26 <div id="page-content">
  27 <div id="preamble"><h1>Apache Module mod_auth_form</h1>
  28 <div class="toplang">
  29 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_form.html" title="English">&nbsp;en&nbsp;</a> |
  30 <a href="../fr/mod/mod_auth_form.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a></p>
  31 </div>
  32 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Form authentication</td></tr>
  33 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
  34 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>auth_form_module</td></tr>
  35 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_auth_form.c</td></tr>
  36 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.3 and later</td></tr></table>
  37 <h3>Summary</h3>
  38
  39     <div class="warning"><h3>Warning</h3>
  40       <p>Form authentication depends on the <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>
  41       modules, and these modules make use of HTTP cookies, and as such can fall
  42       victim to Cross Site Scripting attacks, or expose potentially private
  43       information to clients. Please ensure that the relevant risks have
  44       been taken into account before enabling the session functionality on
  45       your server.</p>
  46     </div>
  47
  48     <p>This module allows the use of an HTML login form to restrict access
  49     by looking up users in the given providers. HTML forms require
  50     significantly more configuration than the alternatives, however an
  51     HTML login form can provide a much friendlier experience for end users.
  52     </p>
  53
  54     <p>HTTP basic authentication is provided by
  55     <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code>, and HTTP digest authentication is
  56     provided by <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>.  This module should
  57     be combined with at least one authentication module
  58     such as <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and one authorization
  59     module such as <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code>.</p>
  60
  61     <p>Once the user has been successfully authenticated, the user's login
  62     details will be stored in a session provided by <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>.
  63     </p>
  64
  65 </div>
  66 <div id="quickview"><h3>Topics</h3>
  67 <ul id="topics">
  68 <li><img alt="" src="../images/down.gif" /> <a href="#basicconfig">Basic Configuration</a></li>
  69 <li><img alt="" src="../images/down.gif" /> <a href="#standalone">Standalone Login</a></li>
  70 <li><img alt="" src="../images/down.gif" /> <a href="#inline">Inline Login</a></li>
  71 <li><img alt="" src="../images/down.gif" /> <a href="#inlinepreservebody">Inline Login with Body Preservation</a></li>
  72 <li><img alt="" src="../images/down.gif" /> <a href="#loggingout">Logging Out</a></li>
  73 <li><img alt="" src="../images/down.gif" /> <a href="#urlencoding">Usernames and Passwords</a></li>
  74 </ul><h3 class="directives">Directives</h3>
  75 <ul id="toc">
  76 <li><img alt="" src="../images/down.gif" /> <a href="#authformauthoritative">AuthFormAuthoritative</a></li>
  77 <li><img alt="" src="../images/down.gif" /> <a href="#authformbody">AuthFormBody</a></li>
  78 <li><img alt="" src="../images/down.gif" /> <a href="#authformdisablenostore">AuthFormDisableNoStore</a></li>
  79 <li><img alt="" src="../images/down.gif" /> <a href="#authformfakebasicauth">AuthFormFakeBasicAuth</a></li>
  80 <li><img alt="" src="../images/down.gif" /> <a href="#authformlocation">AuthFormLocation</a></li>
  81 <li><img alt="" src="../images/down.gif" /> <a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></li>
  82 <li><img alt="" src="../images/down.gif" /> <a href="#authformloginsuccesslocation">AuthFormLoginSuccessLocation</a></li>
  83 <li><img alt="" src="../images/down.gif" /> <a href="#authformlogoutlocation">AuthFormLogoutLocation</a></li>
  84 <li><img alt="" src="../images/down.gif" /> <a href="#authformmethod">AuthFormMethod</a></li>
  85 <li><img alt="" src="../images/down.gif" /> <a href="#authformmimetype">AuthFormMimetype</a></li>
  86 <li><img alt="" src="../images/down.gif" /> <a href="#authformpassword">AuthFormPassword</a></li>
  87 <li><img alt="" src="../images/down.gif" /> <a href="#authformprovider">AuthFormProvider</a></li>
  88 <li><img alt="" src="../images/down.gif" /> <a href="#authformsitepassphrase">AuthFormSitePassphrase</a></li>
  89 <li><img alt="" src="../images/down.gif" /> <a href="#authformsize">AuthFormSize</a></li>
  90 <li><img alt="" src="../images/down.gif" /> <a href="#authformusername">AuthFormUsername</a></li>
  91 </ul>
  92 <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_auth_form">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_auth_form">Report a bug</a></li></ul><h3>See also</h3>
  93 <ul class="seealso">
  94 <li><code class="module"><a href="../mod/mod_session.html">mod_session</a></code></li>
  95 <li><code class="directive"><a href="../mod/mod_authn_core.html#authname">AuthName</a></code></li>
  96 <li><code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code></li>
  97 <li><code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code></li>
  98 <li><a href="../howto/auth.html">Authentication howto</a></li>
  99 <li><a href="#comments_section">Comments</a></li></ul></div>
 100 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 101 <div class="section">
 102 <h2><a name="basicconfig" id="basicconfig">Basic Configuration</a><a title="Permanent link" href="#basicconfig" class="permalink">&para;</a></h2>
 103
 104       <p>To protect a particular URL with <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, you need to
 105       decide where you will store your <var>session</var>, and you will need to
 106       decide what method you will use to authenticate. In this simple example, the
 107       login details will be stored in a session based on
 108       <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code>, and authentication will be attempted against
 109       a file using <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>. If authentication is unsuccessful,
 110       the user will be redirected to the form login page.</p>
 111
 112       <div class="example"><h3>Basic example</h3><pre class="prettyprint lang-config">&lt;Location "/admin"&gt;
 113     AuthFormProvider file
 114     AuthUserFile "conf/passwd"
 115     AuthType form
 116     AuthName "/admin"
 117     AuthFormLoginRequiredLocation "http://example.com/login.html"
 118
 119     Session On
 120     SessionCookieName session path=/
 121
 122     Require valid-user
 123 &lt;/Location&gt;</pre>
 124 </div>
 125
 126       <p>The directive <code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code> will enable
 127       the <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> authentication when set to the value <var>form</var>.
 128       The directives <code class="directive"><a href="#authformprovider">AuthFormProvider</a></code> and
 129       <code class="directive"><a href="../mod/mod_authn_file.html#authuserfile">AuthUserFile</a></code> specify that usernames
 130       and passwords should be checked against the chosen file.</p>
 131
 132       <p>The directives <code class="directive"><a href="../mod/mod_session.html#session">Session</a></code> and
 133       <code class="directive"><a href="../mod/mod_session_cookie.html#sessioncookiename">SessionCookieName</a></code>
 134       session stored within an HTTP cookie on the browser. For more information
 135       on the different options for configuring a session, read the documentation for
 136       <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>.</p>
 137
 138       <p>You can optionally add a
 139       <code class="directive"><a href="../mod/mod_session_crypto.html#sessioncryptopassphrase">SessionCryptoPassphrase</a></code> to
 140       create an encrypted session cookie. This required the additional
 141       module <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code> be loaded.</p>
 142
 143       <p>In the simple example above, a URL has been protected by
 144       <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, but the user has yet to be given an opportunity to
 145       enter their username and password. Options for doing so include providing a
 146       dedicated standalone login page for this purpose, or for providing the login
 147       page inline.</p>
 148     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 149 <div class="section">
 150 <h2><a name="standalone" id="standalone">Standalone Login</a><a title="Permanent link" href="#standalone" class="permalink">&para;</a></h2>
 151
 152       <p>The login form can be hosted as a standalone page, or can be provided inline on
 153       the same page.</p>
 154
 155       <p>When configuring the login as a standalone page, unsuccessful authentication
 156       attempts should be redirected to a login form created by the website for this purpose,
 157       using the <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code>
 158       directive. Typically this login page will contain an HTML form, asking the user to
 159       provide their usename and password.</p>
 160
 161       <div class="example"><h3>Example login form</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;
 162   Username: &lt;input type="text" name="httpd_username" value="" /&gt;
 163   Password: &lt;input type="password" name="httpd_password" value="" /&gt;
 164   &lt;input type="submit" name="login" value="Login" /&gt;
 165 &lt;/form&gt;</pre>
 166 </div>
 167
 168       <p>The part that does the actual login is handled by the <var>form-login-handler</var>.
 169       The action of the form should point at this handler, which is configured within
 170       Apache httpd as follows:</p>
 171
 172       <div class="example"><h3>Form login handler example</h3><pre class="prettyprint lang-config">&lt;Location "/dologin.html"&gt;
 173     SetHandler form-login-handler
 174     AuthFormLoginRequiredLocation "http://example.com/login.html"
 175     AuthFormLoginSuccessLocation "http://example.com/admin/index.html"
 176     AuthFormProvider file
 177     AuthUserFile "conf/passwd"
 178     AuthType form
 179     AuthName /admin
 180     Session On
 181     SessionCookieName session path=/
 182 &lt;/Location&gt;</pre>
 183 </div>
 184
 185       <p>The URLs specified by the
 186       <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code> directive will typically
 187       point to a page explaining to the user that their login attempt was unsuccessful, and they
 188       should try again.  The <code class="directive"><a href="#authformloginsuccesslocation">AuthFormLoginSuccessLocation</a></code>
 189       directive specifies the URL the user should be redirected to upon successful login.</p>
 190
 191       <p>Alternatively, the URL to redirect the user to on success can be embedded within the login
 192       form, as in the example below. As a result, the same <var>form-login-handler</var> can be
 193       reused for different areas of a website.</p>
 194
 195       <div class="example"><h3>Example login form with location</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;
 196   Username: &lt;input type="text" name="httpd_username" value="" /&gt;
 197   Password: &lt;input type="password" name="httpd_password" value="" /&gt;
 198   &lt;input type="submit" name="login" value="Login" /&gt;
 199   &lt;input type="hidden" name="httpd_location" value="http://example.com/success.html" /&gt;
 200 &lt;/form&gt;</pre>
 201 </div>
 202
 203     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 204 <div class="section">
 205 <h2><a name="inline" id="inline">Inline Login</a><a title="Permanent link" href="#inline" class="permalink">&para;</a></h2>
 206
 207       <div class="warning"><h3>Warning</h3>
 208         <p>A risk exists that under certain circumstances, the login form configured
 209         using inline login may be submitted more than once, revealing login credentials to
 210         the application running underneath. The administrator must ensure that the underlying
 211         application is properly secured to prevent abuse. If in doubt, use the
 212         standalone login configuration.</p>
 213       </div>
 214
 215       <p>As an alternative to having a dedicated login page for a website, it is possible to
 216       configure <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> to authenticate users inline, without being
 217       redirected to another page. This allows the state of the current page to be preserved
 218       during the login attempt. This can be useful in a situation where a time limited
 219       session is in force, and the session times out in the middle of the user request. The
 220       user can be re-authenticated in place, and they can continue where they left off.</p>
 221
 222       <p>If a non-authenticated user attempts to access a page protected by
 223       <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> that isn't configured with a
 224       <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code> directive,
 225       a <var>HTTP_UNAUTHORIZED</var> status code is returned to the browser indicating to the user
 226       that they are not authorized to view the page.</p>
 227
 228       <p>To configure inline authentication, the administrator overrides the error document
 229       returned by the <var>HTTP_UNAUTHORIZED</var> status code with a custom error document
 230       containing the login form, as follows:</p>
 231
 232       <div class="example"><h3>Basic inline example</h3><pre class="prettyprint lang-config">AuthFormProvider file
 233 ErrorDocument 401 "/login.shtml"
 234 AuthUserFile "conf/passwd"
 235 AuthType form
 236 AuthName /admin
 237 AuthFormLoginRequiredLocation "http://example.com/login.html"
 238 Session On
 239 SessionCookieName session path=/</pre>
 240 </div>
 241
 242       <p>The error document page should contain a login form with an empty action property,
 243       as per the example below.  This has the effect of submitting the form to
 244       the original protected URL, without the page having to know what that
 245       URL is.</p>
 246
 247       <div class="example"><h3>Example inline login form</h3><pre class="prettyprint lang-html">&lt;form method="POST" <strong>action=""</strong>&gt;
 248   Username: &lt;input type="text" name="httpd_username" value="" /&gt;
 249   Password: &lt;input type="password" name="httpd_password" value="" /&gt;
 250   &lt;input type="submit" name="login" value="Login" /&gt;
 251 &lt;/form&gt;</pre>
 252 </div>
 253
 254       <p>When the end user has filled in their login details, the form will make
 255       an HTTP POST request to the original password protected URL.
 256       <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> will intercept this POST request, and if
 257       HTML fields are found present for the username and password, the user
 258       will be logged in, and the original password protected URL will be returned
 259       to the user as a GET request.</p>
 260
 261     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 262 <div class="section">
 263 <h2><a name="inlinepreservebody" id="inlinepreservebody">Inline Login with Body Preservation</a><a title="Permanent link" href="#inlinepreservebody" class="permalink">&para;</a></h2>
 264
 265       <p>A limitation of the inline login technique described above is that should an
 266       HTML form POST have resulted in the request to authenticate or
 267       reauthenticate, the
 268       contents of the original form posted by the browser will be lost. Depending on
 269       the function of the website, this could present significant inconvenience for the
 270       end user.</p>
 271
 272       <p><code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> addresses this by allowing the method and body
 273       of the original request to be embedded in the login form. If authentication
 274       is successful, the original method and body will be retried by Apache httpd, preserving
 275       the state of the original request.</p>
 276
 277       <p>To enable body preservation, add three additional fields to the login form as
 278       per the example below.</p>
 279
 280       <div class="example"><h3>Example with body preservation</h3><pre class="prettyprint lang-html">&lt;form method="POST" action=""&gt;
 281   Username: &lt;input type="text" name="httpd_username" value="" /&gt;
 282   Password: &lt;input type="password" name="httpd_password" value="" /&gt;
 283   &lt;input type="submit" name="login" value="Login" /&gt;
 284   <br />  <strong>&lt;input type="hidden" name="httpd_method" value="POST" /&gt;
 285   &lt;input type="hidden" name="httpd_mimetype" value="application/x-www-form-urlencoded" /&gt;
 286   &lt;input type="hidden" name="httpd_body" value="name1=value1&amp;name2=value2" /&gt;</strong><br />
 287 &lt;/form&gt;</pre>
 288 </div>
 289
 290       <p>How the method, mimetype and body of the original request are embedded within the
 291       login form will depend on the platform and technology being used within the website.
 292       </p>
 293
 294       <p>One option is to use the <code class="module"><a href="../mod/mod_include.html">mod_include</a></code> module along with the
 295       <code class="directive"><a href="../mod/mod_request.html#keptbodysize">KeptBodySize</a></code> directive, along with a suitable
 296       CGI script to embed the variables in the form.</p>
 297
 298       <p>Another option is to render the login form using a CGI script or other dynamic
 299       technology.</p>
 300
 301       <div class="example"><h3>CGI example</h3><pre class="prettyprint lang-config">        AuthFormProvider file
 302         ErrorDocument 401 "/cgi-bin/login.cgi"
 303         ...</pre>
 304 </div>
 305
 306     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 307 <div class="section">
 308 <h2><a name="loggingout" id="loggingout">Logging Out</a><a title="Permanent link" href="#loggingout" class="permalink">&para;</a></h2>
 309
 310       <p>To enable a user to log out of a particular session, configure a page to
 311       be handled by the <var>form-logout-handler</var>. Any attempt to access this
 312       URL will cause the username and password to be removed from the current
 313       session, effectively logging the user out.</p>
 314
 315       <p>By setting the
 316       <code class="directive"><a href="#authformlogoutlocation">AuthFormLogoutLocation</a></code> directive,
 317       a URL can be specified that the browser will be redirected to on successful
 318       logout. This URL might explain to the user that they have been logged out, and
 319       give the user the option to log in again.</p>
 320
 321       <div class="example"><h3>Basic logout example</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler
 322 AuthName realm
 323 AuthFormLogoutLocation "http://example.com/loggedout.html"
 324 Session On
 325 SessionCookieName session path=/</pre>
 326 </div>
 327
 328       <p>Note that logging a user out does not delete the session; it merely removes
 329       the username and password from the session. If this results in an empty session,
 330       the net effect will be the removal of that session, but this is not
 331       guaranteed. If you want to guarantee the removal of a session, set the
 332       <code class="directive"><a href="../mod/mod_session.html#sessionmaxage">SessionMaxAge</a></code> directive to a small
 333       value, like 1 (setting the directive to zero would mean no session age limit).
 334       </p>
 335
 336       <div class="example"><h3>Basic session expiry example</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler
 337 AuthFormLogoutLocation "http://example.com/loggedout.html"
 338 Session On
 339 SessionMaxAge 1
 340 SessionCookieName session path=/</pre>
 341 </div>
 342
 343     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 344 <div class="section">
 345 <h2><a name="urlencoding" id="urlencoding">Usernames and Passwords</a><a title="Permanent link" href="#urlencoding" class="permalink">&para;</a></h2>
 346     <p>Note that form submission involves URLEncoding the form data:
 347     in this case the username and password.  You should therefore
 348     pick usernames and passwords that avoid characters that are
 349     URLencoded in form submission, or you may get unexpected results.</p>
 350     </div>
 351 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 352 <div class="directive-section"><h2><a name="AuthFormAuthoritative" id="AuthFormAuthoritative">AuthFormAuthoritative</a> <a name="authformauthoritative" id="authformauthoritative">Directive</a><a title="Permanent link" href="#authformauthoritative" class="permalink">&para;</a></h2>
 353 <table class="directive">
 354 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are passed to
 355 lower level modules</td></tr>
 356 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormAuthoritative On|Off</code></td></tr>
 357 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthFormAuthoritative On</code></td></tr>
 358 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 359 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 360 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 361 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 362 </table>
 363     <p>Normally, each authorization module listed in <code class="directive"><a href="#authformprovider">AuthFormProvider</a></code> will attempt
 364     to verify the user, and if the user is not found in any provider,
 365     access will be denied. Setting the
 366     <code class="directive">AuthFormAuthoritative</code> directive explicitly
 367     to <code>Off</code> allows for both authentication and
 368     authorization to be passed on to other non-provider-based modules
 369     if there is <strong>no userID</strong> or <strong>rule</strong>
 370     matching the supplied userID.  This should only be necessary when
 371     combining <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> with third-party modules
 372     that are not configured with the <code class="directive"><a href="#authformprovider">AuthFormProvider</a></code>
 373     directive.  When using such modules, the order of processing
 374     is determined in the modules' source code and is not configurable.</p>
 375
 376 </div>
 377 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 378 <div class="directive-section"><h2><a name="AuthFormBody" id="AuthFormBody">AuthFormBody</a> <a name="authformbody" id="authformbody">Directive</a><a title="Permanent link" href="#authformbody" class="permalink">&para;</a></h2>
 379 <table class="directive">
 380 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying the body of the request to attempt on successful login</td></tr>
 381 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormBody <var>fieldname</var></code></td></tr>
 382 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_body</code></td></tr>
 383 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 384 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 385 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 386 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 387 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 388 </table>
 389     <p>The <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code> directive specifies
 390     the name of an HTML field which, if present, will contain the method of the request to
 391     to submit should login be successful.</p>
 392
 393     <p>By populating the form with fields described by
 394     <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code>,
 395     <code class="directive"><a href="#authformmimetype">AuthFormMimetype</a></code> and
 396     <code class="directive"><a href="#authformbody">AuthFormBody</a></code>, a website can retry
 397     a request that may have been interrupted by the login screen, or by a session
 398     timeout.</p>
 399
 400 </div>
 401 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 402 <div class="directive-section"><h2><a name="AuthFormDisableNoStore" id="AuthFormDisableNoStore">AuthFormDisableNoStore</a> <a name="authformdisablenostore" id="authformdisablenostore">Directive</a><a title="Permanent link" href="#authformdisablenostore" class="permalink">&para;</a></h2>
 403 <table class="directive">
 404 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Disable the CacheControl no-store header on the login page</td></tr>
 405 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormDisableNoStore <var>On|Off</var></code></td></tr>
 406 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthFormDisableNoStore Off</code></td></tr>
 407 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 408 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 409 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 410 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 411 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 412 </table>
 413     <p>The <code class="directive"><a href="#authformdisablenostore">AuthFormDisableNoStore</a></code> flag
 414     disables the sending of a <code>Cache-Control no-store</code> header with the
 415     error 401 page returned when the user is not yet logged in. The purpose of the header
 416     is to make it difficult for an <code>ecmascript</code> application to attempt to resubmit the
 417     login form, and reveal the username and password to the backend application. Disable
 418     at your own risk.</p>
 419
 420
 421 </div>
 422 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 423 <div class="directive-section"><h2><a name="AuthFormFakeBasicAuth" id="AuthFormFakeBasicAuth">AuthFormFakeBasicAuth</a> <a name="authformfakebasicauth" id="authformfakebasicauth">Directive</a><a title="Permanent link" href="#authformfakebasicauth" class="permalink">&para;</a></h2>
 424 <table class="directive">
 425 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Fake a Basic Authentication header</td></tr>
 426 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormFakeBasicAuth <var>On|Off</var></code></td></tr>
 427 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthFormFakeBasicAuth Off</code></td></tr>
 428 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 429 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 430 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 431 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 432 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 433 </table>
 434     <p>The <code class="directive"><a href="#authformfakebasicauth">AuthFormFakeBasicAuth</a></code> flag
 435     determines whether a <code>Basic Authentication</code> header will be added to
 436     the request headers. This can be used to expose the username and password to
 437     an underlying application, without the underlying application having to be aware
 438     of how the login was achieved.</p>
 439
 440
 441 </div>
 442 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 443 <div class="directive-section"><h2><a name="AuthFormLocation" id="AuthFormLocation">AuthFormLocation</a> <a name="authformlocation" id="authformlocation">Directive</a><a title="Permanent link" href="#authformlocation" class="permalink">&para;</a></h2>
 444 <table class="directive">
 445 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying a URL to redirect to on successful login</td></tr>
 446 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormLocation <var>fieldname</var></code></td></tr>
 447 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_location</code></td></tr>
 448 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 449 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 450 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 451 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 452 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 453 </table>
 454     <p>The <code class="directive"><a href="#authformlocation">AuthFormLocation</a></code> directive specifies
 455     the name of an HTML field which, if present, will contain a URL to redirect the browser to
 456     should login be successful.</p>
 457
 458 </div>
 459 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 460 <div class="directive-section"><h2><a name="AuthFormLoginRequiredLocation" id="AuthFormLoginRequiredLocation">AuthFormLoginRequiredLocation</a> <a name="authformloginrequiredlocation" id="authformloginrequiredlocation">Directive</a><a title="Permanent link" href="#authformloginrequiredlocation" class="permalink">&para;</a></h2>
 461 <table class="directive">
 462 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The URL of the page to be redirected to should login be required</td></tr>
 463 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormLoginRequiredLocation <var>url</var></code></td></tr>
 464 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 465 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 466 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 467 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 468 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 469 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later. The use of the expression
 470 parser has been added in 2.4.4.</td></tr>
 471 </table>
 472     <p>The <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code> directive
 473     specifies the URL to redirect to should the user not be authorised to view a page. The value
 474     is parsed using the <a href="../expr.html">ap_expr</a> parser before being sent to the client.
 475     By default, if a user is not authorised to view a page, the HTTP response code
 476     <code>HTTP_UNAUTHORIZED</code> will be returned with the page specified by the
 477     <code class="directive"><a href="../mod/core.html#errordocument">ErrorDocument</a></code> directive. This directive overrides this
 478     default.</p>
 479
 480     <p>Use this directive if you have a dedicated login page to redirect users to.</p>
 481
 482
 483 </div>
 484 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 485 <div class="directive-section"><h2><a name="AuthFormLoginSuccessLocation" id="AuthFormLoginSuccessLocation">AuthFormLoginSuccessLocation</a> <a name="authformloginsuccesslocation" id="authformloginsuccesslocation">Directive</a><a title="Permanent link" href="#authformloginsuccesslocation" class="permalink">&para;</a></h2>
 486 <table class="directive">
 487 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The URL of the page to be redirected to should login be successful</td></tr>
 488 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormLoginSuccessLocation <var>url</var></code></td></tr>
 489 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 490 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 491 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 492 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 493 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 494 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later. The use of the expression
 495 parser has been added in 2.4.4.</td></tr>
 496 </table>
 497     <p>The <code class="directive"><a href="#authformloginsuccesslocation">AuthFormLoginSuccessLocation</a></code> directive
 498     specifies the URL to redirect to should the user have logged in successfully. The value is
 499     parsed using the <a href="../expr.html">ap_expr</a> parser before being sent to the client.
 500     This directive can be overridden if a form field has been defined containing another URL
 501     using the <code class="directive"><a href="#authformlocation">AuthFormLocation</a></code> directive.</p>
 502
 503     <p>Use this directive if you have a dedicated login URL, and you have not embedded the
 504     destination page in the login form.</p>
 505
 506
 507 </div>
 508 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 509 <div class="directive-section"><h2><a name="AuthFormLogoutLocation" id="AuthFormLogoutLocation">AuthFormLogoutLocation</a> <a name="authformlogoutlocation" id="authformlogoutlocation">Directive</a><a title="Permanent link" href="#authformlogoutlocation" class="permalink">&para;</a></h2>
 510 <table class="directive">
 511 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The URL to redirect to after a user has logged out</td></tr>
 512 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormLogoutLocation <var>uri</var></code></td></tr>
 513 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 514 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 515 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 516 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 517 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 518 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later. The use of the expression
 519 parser has been added in 2.4.4.</td></tr>
 520 </table>
 521     <p>The <code class="directive"><a href="#authformlogoutlocation">AuthFormLogoutLocation</a></code> directive
 522     specifies the URL of a page on the server to redirect to should the user attempt to log
 523     out. The value is parsed using the <a href="../expr.html">ap_expr</a> parser before
 524     being sent to the client.</p>
 525
 526     <p>When a URI is accessed that is served by the handler <code>form-logout-handler</code>,
 527     the page specified by this directive will be shown to the end user. For example:</p>
 528
 529     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">&lt;Location "/logout"&gt;
 530     SetHandler form-logout-handler
 531     AuthFormLogoutLocation "http://example.com/loggedout.html"
 532     Session on
 533     #...
 534 &lt;/Location&gt;</pre>
 535 </div>
 536
 537     <p>An attempt to access the URI <var>/logout/</var> will result in the user being logged
 538     out, and the page <var>/loggedout.html</var> will be displayed. Make sure that the page
 539     <var>loggedout.html</var> is not password protected, otherwise the page will not be
 540     displayed.</p>
 541
 542
 543 </div>
 544 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 545 <div class="directive-section"><h2><a name="AuthFormMethod" id="AuthFormMethod">AuthFormMethod</a> <a name="authformmethod" id="authformmethod">Directive</a><a title="Permanent link" href="#authformmethod" class="permalink">&para;</a></h2>
 546 <table class="directive">
 547 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying the method of the request to attempt on successful login</td></tr>
 548 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormMethod <var>fieldname</var></code></td></tr>
 549 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_method</code></td></tr>
 550 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 551 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 552 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 553 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 554 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 555 </table>
 556     <p>The <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code> directive specifies
 557     the name of an HTML field which, if present, will contain the method of the request to
 558     to submit should login be successful.</p>
 559
 560     <p>By populating the form with fields described by
 561     <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code>,
 562     <code class="directive"><a href="#authformmimetype">AuthFormMimetype</a></code> and
 563     <code class="directive"><a href="#authformbody">AuthFormBody</a></code>, a website can retry
 564     a request that may have been interrupted by the login screen, or by a session
 565     timeout.</p>
 566
 567 </div>
 568 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 569 <div class="directive-section"><h2><a name="AuthFormMimetype" id="AuthFormMimetype">AuthFormMimetype</a> <a name="authformmimetype" id="authformmimetype">Directive</a><a title="Permanent link" href="#authformmimetype" class="permalink">&para;</a></h2>
 570 <table class="directive">
 571 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying the mimetype of the body of the request to attempt on successful login</td></tr>
 572 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormMimetype <var>fieldname</var></code></td></tr>
 573 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_mimetype</code></td></tr>
 574 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 575 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 576 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 577 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 578 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 579 </table>
 580     <p>The <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code> directive specifies
 581     the name of an HTML field which, if present, will contain the
 582     mimetype of the request to submit should login be successful.</p>
 583
 584     <p>By populating the form with fields described by
 585     <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code>,
 586     <code class="directive"><a href="#authformmimetype">AuthFormMimetype</a></code> and
 587     <code class="directive"><a href="#authformbody">AuthFormBody</a></code>, a website can retry
 588     a request that may have been interrupted by the login screen, or by a session
 589     timeout.</p>
 590
 591 </div>
 592 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 593 <div class="directive-section"><h2><a name="AuthFormPassword" id="AuthFormPassword">AuthFormPassword</a> <a name="authformpassword" id="authformpassword">Directive</a><a title="Permanent link" href="#authformpassword" class="permalink">&para;</a></h2>
 594 <table class="directive">
 595 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying the login password</td></tr>
 596 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormPassword <var>fieldname</var></code></td></tr>
 597 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_password</code></td></tr>
 598 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 599 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 600 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 601 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 602 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 603 </table>
 604     <p>The <code class="directive"><a href="#authformpassword">AuthFormPassword</a></code> directive specifies
 605     the name of an HTML field which, if present, will contain the password to be used to log
 606     in.</p>
 607
 608 </div>
 609 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 610 <div class="directive-section"><h2><a name="AuthFormProvider" id="AuthFormProvider">AuthFormProvider</a> <a name="authformprovider" id="authformprovider">Directive</a><a title="Permanent link" href="#authformprovider" class="permalink">&para;</a></h2>
 611 <table class="directive">
 612 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the authentication provider(s) for this location</td></tr>
 613 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormProvider <var>provider-name</var>
 614 [<var>provider-name</var>] ...</code></td></tr>
 615 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthFormProvider file</code></td></tr>
 616 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 617 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 618 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 619 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 620 </table>
 621     <p>The <code class="directive">AuthFormProvider</code> directive sets
 622     which provider is used to authenticate the users for this location.
 623     The default <code>file</code> provider is implemented
 624     by the <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> module.  Make sure
 625     that the chosen provider module is present in the server.</p>
 626
 627     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
 628     AuthType form
 629     AuthName "private area"
 630     AuthFormProvider  dbm
 631     AuthDBMType        SDBM
 632     AuthDBMUserFile    "/www/etc/dbmpasswd"
 633     Require            valid-user
 634     #...
 635 &lt;/Location&gt;</pre>
 636 </div>
 637
 638     <p>Providers are implemented by <code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>,
 639     <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>, <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>,
 640     <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> and <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>.</p>
 641
 642 </div>
 643 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 644 <div class="directive-section"><h2><a name="AuthFormSitePassphrase" id="AuthFormSitePassphrase">AuthFormSitePassphrase</a> <a name="authformsitepassphrase" id="authformsitepassphrase">Directive</a><a title="Permanent link" href="#authformsitepassphrase" class="permalink">&para;</a></h2>
 645 <table class="directive">
 646 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Bypass authentication checks for high traffic sites</td></tr>
 647 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormSitePassphrase <var>secret</var></code></td></tr>
 648 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 649 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 650 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 651 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 652 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 653 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 654 </table>
 655     <p>The <code class="directive"><a href="#authformsitepassphrase">AuthFormSitePassphrase</a></code> directive
 656     specifies a passphrase which, if present in the user session, causes Apache httpd to
 657     bypass authentication checks for the given URL. It can be used on high traffic websites
 658     to reduce the load induced on authentication infrastructure.</p>
 659
 660     <p>The passphrase can be inserted into a user session by adding this directive to the
 661     configuration for the <var>form-login-handler</var>. The <var>form-login-handler</var>
 662     itself will always run the authentication checks, regardless of whether a passphrase
 663     is specified or not.</p>
 664
 665     <div class="warning"><h3>Warning</h3>
 666       <p>If the session is exposed to the user through the use of
 667       <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code>, and the session is not protected with
 668       <code class="module"><a href="../mod/mod_session_crypto.html">mod_session_crypto</a></code>, the passphrase is open to potential exposure
 669       through a dictionary attack. Regardless of how the session is configured,
 670       ensure that this directive is not used within URL spaces where private user data
 671       could be exposed, or sensitive transactions can be conducted. Use at own risk.</p>
 672     </div>
 673
 674
 675 </div>
 676 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 677 <div class="directive-section"><h2><a name="AuthFormSize" id="AuthFormSize">AuthFormSize</a> <a name="authformsize" id="authformsize">Directive</a><a title="Permanent link" href="#authformsize" class="permalink">&para;</a></h2>
 678 <table class="directive">
 679 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The largest size of the form in bytes that will be parsed for the login details</td></tr>
 680 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormSize <var>size</var></code></td></tr>
 681 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>8192</code></td></tr>
 682 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 683 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 684 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 685 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 686 </table>
 687     <p>The <code class="directive"><a href="#authformsize">AuthFormSize</a></code> directive specifies
 688     the maximum size of the body of the request that will be parsed to find the login form.</p>
 689
 690     <p>If a login request arrives that exceeds this size, the whole request will be aborted
 691     with the HTTP response code <code>HTTP_REQUEST_TOO_LARGE</code>.</p>
 692
 693     <p>If you have populated the form with fields described by
 694     <code class="directive"><a href="#authformmethod">AuthFormMethod</a></code>,
 695     <code class="directive"><a href="#authformmimetype">AuthFormMimetype</a></code> and
 696     <code class="directive"><a href="#authformbody">AuthFormBody</a></code>, you probably want to set this
 697     field to a similar size as the <code class="directive"><a href="../mod/mod_request.html#keptbodysize">KeptBodySize</a></code>
 698     directive.</p>
 699
 700
 701 </div>
 702 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 703 <div class="directive-section"><h2><a name="AuthFormUsername" id="AuthFormUsername">AuthFormUsername</a> <a name="authformusername" id="authformusername">Directive</a><a title="Permanent link" href="#authformusername" class="permalink">&para;</a></h2>
 704 <table class="directive">
 705 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>The name of a form field carrying the login username</td></tr>
 706 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthFormUsername <var>fieldname</var></code></td></tr>
 707 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>httpd_username</code></td></tr>
 708 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
 709 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 710 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 711 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_form</td></tr>
 712 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache HTTP Server 2.3.0 and later</td></tr>
 713 </table>
 714     <p>The <code class="directive"><a href="#authformusername">AuthFormUsername</a></code> directive specifies
 715     the name of an HTML field which, if present, will contain the username to be used to log
 716     in.</p>
 717
 718 </div>
 719 </div>
 720 <div class="bottomlang">
 721 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_form.html" title="English">&nbsp;en&nbsp;</a> |
 722 <a href="../fr/mod/mod_auth_form.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a></p>
 723 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
 724 <script type="text/javascript"><!--//--><![CDATA[//><!--
 725 var comments_shortname = 'httpd';
 726 var comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_auth_form.html';
 727 (function(w, d) {
 728     if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
 729         d.write('<div id="comments_thread"><\/div>');
 730         var s = d.createElement('script');
 731         s.type = 'text/javascript';
 732         s.async = true;
 733         s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
 734         (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
 735     }
 736     else {
 737         d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
 738     }
 739 })(window, document);
 740 //--><!]]></script></div><div id="footer">
 741 <p class="apache">Copyright 2018 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 742 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
 743 if (typeof(prettyPrint) !== 'undefined') {
 744     prettyPrint();
 745 }
 746 //--><!]]></script>
 747 </body></html>