28 Sep
2006
28 Sep
'06
8:56 a.m.
Hallo, IOhannes m zmoelnig hat gesagt: // IOhannes m zmoelnig wrote:
Mathieu Bouchard wrote:
Why not use challenge-response authentication over plain http? That's secure enough, yes?
so how?
I think, Matju refers to basic or digest http authentificaton, which is a step backwards from using SSL, so as we already have SSL working, I would not recommend it. But redirecting users to plain http-pages after they have logged in over SSL is a pretty common design pattern in Web applications. I found this page which addresses this and various other login stuff:
http://plone.org/documentation/how-to/secure-login-without-plain-text-passwo...
Search for "came_from".
Ciao
--
Frank Barknecht _ ______footils.org_ __goto10.org__