Basic-like authentication

[hspc]

Hi
I try to restrict access to some pages..
I don't want to use username/password text Input controls,,
instead I want to display the basic authentication dialog but i face a problem reading the username/password that the user inputs :

Response.Clear
Response.Write Request.ServerVariables("AUTH_USER")
if Request.ServerVariables("AUTH_USER")<>"ABC" and Request.ServerVariables("AUTH_PASSWORD")<>"123" then
Response.AddHeader "WWW-Authenticate","basic"
Response.Status="401"
Response.End
else
Response.Write "user=" & Request.ServerVariables("AUTH_USER") & vbCrLf
Response.Write "PWD=" & Request.ServerVariables("AUTH_PASSWORD")
end if

the dialog shows up and i input data but seems that the checking for AUTH_USER and AUTH_PASSWORD is wrong..
please help me with this.
I use IIS 5.0 and basic authentication is enabled.

[hspc]

Hi
a friend form another site solved it for me :
AUTH_USER and AUTH_PASSWORD are populated by IIS if it requested the authentication itself.

You need to check the HTTP_AUTHORIZATION variable. This will be Base64 encoded and will encompass both the username and password. See the specification I posted earlier to figure out how it is put together.


also pointed me to :http://www.w3.org/Protocols/HTTP/1.0/draft-ietf-http-spec.html#WWW-Authenticate

now i'm going to decode the Base64 encoded string.
...
just wanted to share :)