Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread ohaya
Hi,  To be honest basic authentication is not a preference, but I'm looking into it because OAM supports what do you call sessionless basic authentication. And that is the only authentication method that OAM supports that doesn't require redirects, and previous work that I've done ready to probl

Re: [users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread Daniel Gruno
Slightly off-topic, but you might wanna check out https://developer.mozilla.org/en-US/docs/Web/API/fetch#parameters Standard modern behavior, AIUI, is to not do Basic Auth via JavaScript fetches unless it's the same site, but this can be modified. But I could be wrong :) On 04/10/2021 03.04, o

[users@httpd] Browsers appear to be ignoring 401 responses with WWW-Authenticate

2021-10-03 Thread ohaya
Hi, We are hosting a page on one of our Apache (2.4.29). We use Oracle OAM webgate in this Apache to "protect" that page. When the webgate is installed into the Apache, they include a configuration file that has: AuthType Oblix require valid-user We have this page configured for BASIC auth

[users@httpd] OT: questions on SSL certs for server to server communications, where to install & penetration testing them

2021-10-03 Thread Sunhux G
a vendor is setting up on-prem internal servers for us: vendor told us he needs SSL certs for the 5 servers (there's 5 URLs given) not for users to access but for server to server communications Q1: Shall we use self-signed certs in this case & usually for how long these certs should be valid (eve