[Zope-Coders] Wrong username and password == Anonymous User?

[Sidnei da Silva]

On Wed, Apr 20, 2005 at 12:38:42PM +1000, Richard Jones wrote:
| On Wed, 20 Apr 2005 12:09 pm, Sidnei da Silva wrote:
| > - If you want to access a anonymous page, you will *not* be sending
| >   auth credentials.
| 
| Why do you say that? Cooke auth doesn't distinguish between anonymous pages 
| and pages that require a user, so the cookie will be sent for every request. 
| IIRC, this is also how Basic Auth works, once your browser knows you've got 
| valid credentials for a site.

That is totally fine. As long as the credentials are valid. If they
are invalid you should be promptly requested to provide valid
credentials no?

Again:

- Not sending credentials is fine for anonymous pages
- Sending valid credentials is fine for all pages
- Sending invalid credentials should fail as early as possible.

-- 
Sidnei da Silva <sidnei at awkly.org>
http://awkly.org - dreamcatching :: making your dreams come true
http://www.enfoldsystems.com
http://plone.org/about/team#dreamcatcher

All the existing 2.0.x kernels are to buggy for 2.1.x to be the
main goal.
	-- Alan Cox