Optional HTTP Authentication

Optional HTTP Authentication is possible. This article describes how.

Problem

Optional HTTP authentication would be useful in a case where a website was visible without authentication, but more features or content are available with authentication.

Some have claimed that optional HTTP authentication is not possible. This is not actually the case, but support for it could be improved.

Solutions

The first two solutions, neither of which requires changes to the RFC, have the same basic process; that pages on the site will not insist on any HTTP authentication (ie. will not by default send WWW-Authenticate headers), but will be willing to accept HTTP authentication from the browser. The only exception is the page that is the target of the "Login" link; it should insist on authentication. Once this has been done, the browser will resend authentication to any page on the site, and it can be picked up and used by those pages as they see fit.

The idea behind these solutions was derived from Mr. John Hanely's comment on the article HTTP Authentication Woes by Mr. Bill Venners.

Immediate solution: mod_perl optional HTTP authentication

1. mod_perl: Protecting Your Site
2. Self-registering password protection, by Randal Schwartz

These should enable you to implement something appropriate in mod_perl. I actually have a module suite which I hope someday to post to CPAN which does optional HTTP authentication using any of the Authen::Simple modules as its backend, and can use either HTTP authentication or session-based (ie. cookies) authentication as its frontend. It also works with HTML Mason.

Medium-term solution: Simple Apache optional HTTP authentication

I've suggested to the Apache project that they could implement optional HTTP authentication. I've suggested this at httpd bug 41685. Unfortunately I'm unaware of any reponse to this, but the change should be entirely possible.

Long-term solution: Change the RFC

Mr. Charles Miller, in Saving HTTP Authentication, offers a solution, but it involves changing the HTML RFC. While this is the best long-term solution, it's not an immediate solution.