view release on metacpan or  search on metacpan

lib/Apache2_4/AuthCookie.pm  view on Meta::CPAN

        # user is not yet authenticated
        return Apache2::Const::AUTHZ_DENIED_NO_USER;
    }

    if (is_blank($requires)) {
        $r->server->log_error(q[Your 'Require user ...' config does not specify any users]);
        return Apache2::Const::AUTHZ_DENIED;
    }

    my $debug = $r->dir_config("AuthCookieDebug") || 0;

    $r->server->log_error("authz user=$user type=$auth_type req=$requires") if $debug >=3;

    for my $valid_user (split /\s+/, $requires) {
        if ($user eq $valid_user) {
            return Apache2::Const::AUTHZ_GRANTED;
        }
    }

    # log a message similar to mod_authz_user
    $r->log->debug(sprintf
        q[access to %s failed, reason: user '%s' does not meet 'require'ments for a ].
        q[user to be allowed access], $r->uri, $r->user);

    return Apache2::Const::AUTHZ_DENIED;
}

1;

=pod

=encoding UTF-8

=head1 NAME

Apache2_4::AuthCookie - Perl Authentication and Authorization via cookies for Apache 2.4

=head1 VERSION

version 3.32

=head1 SYNOPSIS

Make sure your mod_perl is at least 2.0.9, with StackedHandlers,
MethodHandlers, Authen, and Authz compiled in.

 # In httpd.conf or .htaccess:
 PerlModule Sample::Apache2::AuthCookieHandler
 PerlSetVar WhatEverPath /
 PerlSetVar WhatEverLoginScript /login.pl

 # The following line is optional - it allows you to set the domain
 # scope of your cookie.  Default is the current domain.
 PerlSetVar WhatEverDomain .yourdomain.com

 # Use this to only send over a secure connection
 PerlSetVar WhatEverSecure 1

 # Use this if you want user session cookies to expire if the user
 # doesn't request a auth-required or recognize_user page for some
 # time period.  If set, a new cookie (with updated expire time)
 # is set on every request.
 PerlSetVar WhatEverSessionTimeout +30m

 # to enable the HttpOnly cookie property, use HttpOnly.
 # This is an MS extension.  See:
 # http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp
 PerlSetVar WhatEverHttpOnly 1

 # to enable the SameSite cookie property, set SameSite to "lax" or "strict".
 # See: https://www.owasp.org/index.php/SameSite
 PerlSetVar WhatEverSameSite strict

 # Usually documents are uncached - turn off here
 PerlSetVar WhatEverCache 1

 # Use this to make your cookies persistent (+2 hours here)
 PerlSetVar WhatEverExpires +2h

 # Use to make AuthCookie send a P3P header with the cookie
 # see http://www.w3.org/P3P/ for details about what the value 
 # of this should be
 PerlSetVar WhatEverP3P "CP=\"...\""

 # optional: enable decoding of intercepted GET/POST params:
 PerlSetVar WhatEverEncoding UTF-8

 # optional: enable decoding of httpd.conf "Requires" directives
 PerlSetVar WhatEverRequiresEncoding UTF-8

 # These documents require user to be logged in.
 <Location /protected>
  AuthType Sample::Apache2::AuthCookieHandler
  AuthName WhatEver
  PerlAuthenHandler Sample::Apache2::AuthCookieHandler->authenticate
  Require valid-user
 </Location>

 # How to handle a custom requirement (non-user).
 PerlAddAuthzProvider species Sample::Apache2::AuthCookieHandler->authz_species
 <Location /protected/species>
   Require species klingon
 </Location>

 # These documents don't require logging in, but allow it.
 <FilesMatch "\.ok$">
  AuthType Sample::Apache2::AuthCookieHandler
  AuthName WhatEver
  PerlFixupHandler Sample::Apache2::AuthCookieHandler->recognize_user
 </FilesMatch>

 # This is the action of the login.pl script above.
 <Files LOGIN>
  AuthType Sample::Apache2::AuthCookieHandler
  AuthName WhatEver
  SetHandler perl-script
  PerlResponseHandler Sample::Apache2::AuthCookieHandler->login
 </Files>

=head1 DESCRIPTION