Session & Password Manager API

[PMB9]

I want an API like storePassword(username, password) on my website which shows the user a "Do you want your browser to remember the password for username on example.com?" dialog.

Also I like to have an login(username, password) and logout() command for HTTP Authentication.

[JAB Creations]

This is already built in to browsers; I recommend if the browser you're using doesn't already support this to post a feature request in the channels made available by that particular vendor.

[PMB9]

Sorry, I don't know any browser with these features. I'm using Firefox and Bug #287957 is not fixed.

Is there any W3C standard for this?

[JAB Creations]

The second bit you wanted is really HTTP related more then anything I imagine.

A Firefox bug not fixed? I couldn't imagine that...

So you're trying to authenticate through Apache? Why? It's not a full fledged authentication system as far as I can tell. Stick to a serverside language and database setup such as PHP and MySQL.

[PMB9]

Why do I need PHP and MySQL? Only for Authentication? HTTP Authentication is simple and nice. I only need a logout() function.

[lyosha]

This is a feature request for HTTP, not HTML. We would need an HTTP header to define "logging out" and for browsers to support it.

[PMB9]

This is a feature request for HTTP, not HTML. We would need an HTTP header to define "logging out" and for browsers to support it.

I don't think so. HTTP-Logout is a client-side feature.

I'm also interested in something like window.authenticate() (compare with window.confirm())

Code: Select all

authentication = window.authenticate("member-only room");
memberdata = new XMLHttpRequest();
memberdata.open('GET', 'member.xml', true, authentication.user, authentication.password);
...


[JAB Creations]

GET request
Server --> HTTP --> Client

POST request
Server <-- HTTP <-- Client

HTTP is the protocol that works between the client and the server. Both clientside and serverside applications must adhere to the HTTP protocol if you are to have any successful interaction over the internet.

You clearly do not understand that nor serverside development as any one respectably experienced with serverside programming has to have an important grasp on security of which the number one rule is to never trust clientside data.

[PMB9]

You are talking about a standard way to logout from a cookie session, isn't it? I'm talking about HTTP Authentication.