Apache Module mod_auth_form

modules, and these modules make use of HTTP cookies, and as such can fall victim to Cross Site Scripting attacks, or expose potentially private information to clients. Please ensure that the relevant risks have been taken into account before enabling the session functionality on your server.mod_session

This module allows the use of an HTML login form to restrict access by looking up users in the given providers. HTML forms require significantly more configuration than the alternatives, however an HTML login form can provide a much friendlier experience for end users.

, and HTTP digest authentication is provided by modauthbasic

. This module should be combined with at least one authentication module such as modauthdigest

, and authentication will be attempted against a file using modsessioncookie

. If authentication is unsuccessful, the user will be redirected to the form login page.modauthnfile

AuthFormProvider file AuthUserFile conf/passwd AuthType form AuthName realm AuthFormLoginRequiredLocation http://example.com/login.html Session On SessionCookieName session path=/ SessionCryptoPassphrase secret

specify that usernames and passwords should be checked against the chosen file.AuthUserFile

create an encrypted session stored within an HTTP cookie on the browser. For more information on the different options for configuring a session, read the documentation for SessionCryptoPassphrase

, but the user has yet to be given an opportunity to enter their username and password. Options for doing so include providing a dedicated standalone login page for this purpose, or for providing the login page inline.modauthform

When configuring the login as a standalone page, unsuccessful authentication attempts should be redirected to a login form created by the website for this purpose, using the

directive. Typically this login page will contain an HTML form, asking the user to provide their usename and password.AuthFormLoginRequiredLocation

The part that does the actual login is handled by the form-login-handler. The action of the form should point at this handler, which is configured within Apache httpd as follows:

SetHandler form-login-handler AuthFormLoginRequiredLocation http://example.com/login.html AuthFormLoginSuccessLocation http://example.com/success.html AuthFormProvider file AuthUserFile conf/passwd AuthType form AuthName realm Session On SessionCookieName session path=/ SessionCryptoPassphrase secret

The URLs specified by the

directive will typically point to a page explaining to the user that their login attempt was unsuccessful, and they should try again. The AuthFormLoginRequiredLocation

Alternatively, the URL to redirect the user to on success can be embedded within the login form, as in the example below. As a result, the same form-login-handler can be reused for different areas of a website.

As an alternative to having a dedicated login page for a website, it is possible to configure

to authenticate users inline, without being redirected to another page. This allows the state of the current page to be preserved during the login attempt. This can be useful in a situation where a time limited session is in force, and the session times out in the middle of the user request. The user can be re-authenticated in place, and they can continue where they left off.modauthform

directive, a AuthFormLoginRequiredLocationHTTP_UNAUTHORIZED status code is returned to the browser indicating to the user that they are not authorized to view the page.

To configure inline authentication, the administrator overrides the error document returned by the HTTP_UNAUTHORIZED status code with a custom error document containing the login form, as follows:

AuthFormProvider file ErrorDocument 401 /login.shtml AuthUserFile conf/passwd AuthType form AuthName realm AuthFormLoginRequiredLocation http://example.com/login.html Session On SessionCookieName session path=/ SessionCryptoPassphrase secret

The error document page should contain a login form with an empty action property, as per the example below. This has the effect of submitting the form to the original protected URL, without the page having to know what that URL is.

will intercept this POST request, and if HTML fields are found present for the username and password, the user will be logged in, and the original password protected URL will be returned to the user as a GET request.modauthform

addresses this by allowing the method and body of the original request to be embedded in the login form. If authentication is successful, the original method and body will be retried by Apache httpd, preserving the state of the original request.modauthform

To enable body preservation, add three additional fields to the login form as per the example below.

How the method, mimetype and body of the original request are embedded within the login form will depend on the platform and technology being used within the website.

module along with the mod_include

directive, along with a suitable CGI script to embed the variables in the form.KeptBodySize

Another option is to render the login form using a CGI script or other dynamic technology.

directive, a URL can be specified that the browser will be redirected to on successful logout. This URL might explain to the user that they have been logged out, and give the user the option to log in again.AuthFormLogoutLocation

Note that logging a user out does not delete the session; it merely removes the username and password from the session. If this results in an empty session, the net effect will be the removal of that session, but this is not guaranteed. If you want to guarantee the removal of a session, set the

directive to a small value, like 1 (setting the directive to zero would mean no session age limit). SessionMaxAge

Note that form submission involves URLEncoding the form data: in this case the username and password. You should therefore pick usernames and passwords that avoid characters that are URLencoded in form submission, or you may get unexpected results.

allows for both authentication and authorization to be passed on to other non-provider-based modules if there is no userID or rule matching the supplied userID. This should only be necessary when combining

with third-party modules that are not configured with the modauthform

directive. When using such modules, the order of processing is determined in the modules' source code and is not configurable.AuthFormProvider

, a website can retry a request that may have been interrupted by the login screen, or by a session timeout.AuthFormBody

application to attempt to resubmit the login form, and reveal the username and password to the backend application. Disable at your own risk.

directive specifies the URL to redirect to should the user not be authorised to view a page. The value is parsed using the AuthFormLoginRequiredLocationapexpr parser before being sent to the client. By default, if a user is not authorised to view a page, the HTTP response code HTTPUNAUTHORIZED

When a URI is accessed that is served by the handler form-logout-handler

An attempt to access the URI /logout/ will result in the user being logged out, and the page /loggedout.html will be displayed. Make sure that the page loggedout.html is not password protected, otherwise the page will not be displayed.

AuthType form AuthName "private area" AuthFormProvider dbm AuthDBMType SDBM AuthDBMUserFile /www/etc/dbmpasswd Require valid-user #...

The passphrase can be inserted into a user session by adding this directive to the configuration for the form-login-handler. The form-login-handler itself will always run the authentication checks, regardless of whether a passphrase is specified or not.

If the session is exposed to the user through the use of

, the passphrase is open to potential exposure through a dictionary attack. Regardless of how the session is configured, ensure that this directive is not used within URL spaces where private user data could be exposed, or sensitive transactions can be conducted. Use at own risk.modsessioncrypto

If a login request arrives that exceeds this size, the whole request will be aborted with the HTTP response code HTTPREQUESTTOO_LARGE

, you probably want to set this field to a similar size as the AuthFormBody

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4