Questions tagged [authentication]

Authentication is commonly understood as the act of asserting a user's or entity's identity, although in the wider sense it can refer to asserting the truthfulness of any kind of claim. Authentication, like encryption, is a major component in implementing computer security.

Filter by
Sorted by
Tagged with
0 votes
1 answer
7 views

How to disable windows login (so that WAMP can auto start)

I have Wamp 3.2.6 installed on a Windows 10 machine. I use it to serve photos and other files, and some apps, to my local community. Its not mission critical, so I don't monitor the machine constantly....
user avatar
  • 71
2 votes
1 answer
34 views

Can Google index page that is login-required and redirects to Login page?

I have one link that is login-required http://example.com/secret If user access the page without authentication it will be redirected to http://example.com/login page. My question is can Google bot ...
user avatar
2 votes
1 answer
28 views

How to exclude bounces from users just clicking "Sign In App" to navigate to a subdomain in Google Analytics?

I've got www.example.com and app.example.com. I control both. On the "www" site, there's a "Sign In" hyperlink that sends people to the app's login page (a known URL on the app ...
user avatar
  • 121
12 votes
7 answers
3k views

What is an API key?

When we login to a service via a user account, we are normally required to provide an email and password (and on some occasions a username as well). But, when one website's API authenticates to ...
user avatar
  • 121
5 votes
2 answers
953 views

How to allow Googlebot unlimited crawling but to have a limit on individual users?

My website consists of multiple pages, each page is for a company. I plan to allow users that are not signed in to view the company pages, but limit to 10 companies a month. I will use a cookie to ...
user avatar
  • 309
2 votes
1 answer
61 views

Content that should be protected is served without authentication intermittently

Our website hosting is with a shared hosting provider. The only configuration we can make is through .htaccess files, we can't touch the apache configuration files that are sourced when apache first ...
user avatar
1 vote
1 answer
407 views

Can't turn off two-factor authentication for my Heroku web hosting account, even by using the command line instructions

I got a new phone and didn't save the recovery code. One day, when I tried to log in to the Heroku platform using my email and password, Heroku redirected to the https://verify.salesforce.com/v1/...
user avatar
2 votes
1 answer
119 views

Should I automatically delete accounts if they have not verified their email address?

I am launching a new site soon and in my previous experience I know many bots will create accounts, I'm trying to avoid this so before a user can sign in they need to verify their email address. If ...
user avatar
1 vote
1 answer
123 views

Is DMARC relaxed alignment for SPF/DKIM bad?

After studying authentication mechanisms available to prevent e-mail spoofing, still I don't understand how to choose between the relaxed alignment and the strict alignment in DMARC for SPF and DKIM, ...
user avatar
  • 13
1 vote
1 answer
124 views

Order of operations for CloudFlare and WordFence

A friend's website is connected to CloudFlare, through the domain name at least, and has WordFence installed. It was my understanding that CloudFlare has security that would block attackers, but ...
user avatar
0 votes
0 answers
12 views

How can you set up certificates for clients to use in to log into a webpage in comparison to a username and password? [duplicate]

I've relatively new here and in the website world. I recently saw that some webpages (eg. some banks) use certificates for logging in. An example of what I'm looking for is here - http://poczta....
user avatar
0 votes
0 answers
22 views

Show contents of a basic authentication login-protected site on my site with a proxy

I administer website A that provides information for a number of users. Website B is an external website containing information that I would like to provide to the users of site A. Login credentials ...
user avatar
  • 1
0 votes
0 answers
13 views

Joomla admin log in denied

I moved my site from wordpress to Joomla. I created account and was working fine. I tried to log into admin few days later but now my credentials arent being accepted. tried retrieving username and ...
user avatar
  • 1
1 vote
0 answers
52 views

How to prepare my website to Google's oncoming change regarding embedded browser frameworks?

I recently received an email from Google saying that: We are writing to let you know that Google will discontinue support for sign-ins to Google accounts from embedded browser frameworks, starting ...
user avatar
3 votes
1 answer
70 views

How to prevent login from 3rd party sites and apps

Most website content is only accessible after logging in. 3rd party sites (and apps) provide alternative interfaces to the site by passing on the login credentials and scraping content. How do I make ...
user avatar
  • 31
0 votes
0 answers
62 views

Why can't I send emails with my domain name emails without deliverability issues?

I have separate my website and email hosting. I use yandex smail service for email hosting. Everytime I send and email to an address, I get no dkim authentication issue even though, I have configured ...
user avatar
0 votes
1 answer
52 views

How to get a website with a custom password entry form in index.php to prohibit access to all other files and folders

I have a family history website, call it "my_family.com". The primary file, index.php, has some introductory remarks of explanation and an html form into which one puts the website's ...
user avatar
2 votes
0 answers
70 views

Safari prompts for BasicAuth credentials on every request in WordPress admin area, but works fine on the rest of the site

I have a WordPress website which is in development, and is hidden behind a BasicAuth password prompt. My root level .htaccess file: AuthType Basic AuthName "Login Details" AuthUserFile /var/...
user avatar
1 vote
0 answers
33 views

SEO URL Behind Login That May/May Not Require Payment Structure

I have the following parent URL: example.com/courses/course_name/ Currently, that parent URL can be accessed without a login. When a user is logged in, and they try to access a video child URL, 2 ...
user avatar
0 votes
0 answers
372 views

SEO How To Handle Pages That Require Login & Payment?

If you have URLs on your site that require a login but a user who is not logged in tries to access those login required URLs, how do you handle it? 401, 403, 404, 301 to a login page? If the page ...
user avatar
1 vote
1 answer
3k views

why I can't login to cPanel, shows error Maximum Users Exceeded?

When I try to login to cPanel, it shows an error Maximum Users Exceeded. please see the error message below. I didn't do any changes to server. this appears very suddenly. how can I fix this? I ...
user avatar
3 votes
1 answer
301 views

In Apache make subdirectory require basic authentication while parent directory is open to the public

I want to make the contents of the directory /srv/www/dssx (mostly) public. The sub-directory /srv/www/dssx/basic-auth of /srv/www/dssx I want to protect with basic authentication. However, I cannot ...
user avatar
  • 151
1 vote
0 answers
513 views

How to disable Google Ads two-step authentication

I currently am using my Gmail for SMTP for my site. But I also signed up for Google Ads. To sign into Google Ads, I have to two-step authenticate. But because of this, it disables the SMTP for my ...
user avatar
  • 111
2 votes
1 answer
56 views

increasing number of malicious login attempts- what to do?

My question is similar to this one, except that the automatted login attempts are using not nonsensical user names, but real ones that were used in the past on this site. It became infected with a ...
user avatar
1 vote
1 answer
27 views

How to correctly SEO positioning of articles that require authorization

I have website with lot of articles, but that require sign-in to view it. The titles of articles are public. When user is not logged in but wants to see and read it, then will be redirected to login ...
user avatar
  • 111
4 votes
1 answer
82 views

Does the presence of a flash banner on a site inherently create a vulnerability on the site?

Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page. The page in ...
user avatar
0 votes
1 answer
60 views

Unable to login to local DHIS2: Getting a null value in the SessionId

I have installed DHIS 2 version 2.33.0 on a local instance following steps mentioned here. I have also restored the sample database dump. I am able to create new users, but couldn’t log in using ...
user avatar
  • 11
1 vote
1 answer
59 views

How can we turn off some LinkedIn login permissions to our website?

Our website is allowing logins from LinkedIn, but we are asking too many permissions from users. The permission we are asking are: Use your name and photo Use the primary email address associated ...
user avatar
1 vote
1 answer
179 views

Does django-oauth-toolkit handle pkce with oath2?

I am trying to implement oauth2 to my django app. I tried to use django-oauth-toolkit. I think their documentation is outdated and could not find any mention of pkce. Also, I could not find any ...
user avatar
  • 139
1 vote
0 answers
9 views

Storing session data between servers (and noob guidance) [closed]

First post here, I'm sure this information is somewhere on the web, but the problem is I'm such a noob I don't know what to search for. So, my problem is that I want to design a sign up API. Let's ...
user avatar
  • 111
1 vote
2 answers
60 views

Can I restrict access to certain areas of my site using the user's access to restricted areas of another site?

I'd like to restrict access to certain areas of my site (site X) based on whether or not the user has access to certain restricted areas of another site (site Y), which is not under my control. To be ...
user avatar
2 votes
1 answer
159 views

How can I ban mediawiki logins from IPs that persistently fail?

I have a MediaWiki website and someone is trying to login as my WikiSysop user by guessing lots of passwords. What can I do to ban IPs if they exceed a threshold of failed login attempts? (Okay, no-...
user avatar
  • 323
1 vote
0 answers
34 views

Do Google Analytics sessions get broken when tracking UserID and ClientID across subdomains that may not send that data?

I have a domain name with three subdomains. One where a user is authenticated and two where they aren't. I'm planning on implementing UserID tracking for Google Analytics in place of the standard ...
user avatar
1 vote
0 answers
54 views

After implementing HTTPS, "require valid-user" in subdirectory no longer asks for password, just gives 401 Not Authorized

I'm not very knowledgeable about server scripting, however I've only just installed SSL certificate for the domain. The main website (hosted by GoDaddy) is now working fine on SSL/TLS and I've ...
user avatar
  • 11
1 vote
1 answer
96 views

Do most websites not use HTTP authentication header but something else for authentication?

https://curl.haxx.se/docs/httpscripting.html says It is worth noting that while this is how HTTP Authentication works, very many web sites will not use this concept when they provide logins etc. ...
user avatar
  • 113
1 vote
0 answers
19 views

Allow our own systems to use an API and restrict it from the general internet without using authentication

I have an Apache server which is reverse proxy'd to some Java container. In Java container there is an API that we don't want internet to see but expect our own systems to use it without any ...
user avatar
1 vote
0 answers
1k views

Append basic authentication header NGINX to existing authentication header of upstream application

Assume the following setup: The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
user avatar
  • 111
0 votes
1 answer
48 views

It is harder for users to log on to my website when using gmails "+company" email address feature. How can I help them?

If you have a website and lots of people create his accounts with this format: mail+mycompanysite@gmail.com mail+companysite@gmail.com mail+company_site@gmail.com This issue is causing me several ...
user avatar
  • 222
1 vote
1 answer
39 views

How do I log in into Apache web server on Ubuntu from Windows?

I've been given a username and password for an Apache server, that runs on Ubuntu, and belongs to my professor. I do not know how to connect to the server from my machine(windows), and run scripts ...
user avatar
1 vote
0 answers
464 views

Why does CPanel keep prompting me for credentials

When I login directly to CPanel, I login successfully and can see various parts of CPanel (text only, no images), but the system keeps prompting me to login again. When I login via WHM, everything ...
user avatar
2 votes
1 answer
79 views

Individual directory options for every VirtualHost in Apache2

I have a Debian 9 server with two static IPv4 addresses. One of them is public and the other one is in the server's VPN subnet (the machine is running an OpenVPN server). There is a DNS server in the ...
user avatar
1 vote
0 answers
29 views

double authentication for https password protected password

I am hosting a customer's OpenCart store on my own domain hosting. I have add-on domain in my CPanel for customer's domain and created sub domain for it to ease access. Other than the double ...
user avatar
1 vote
1 answer
68 views

Can DHIS2 provision users in advance and then have them log in using OAuth2?

We are looking at using DHIS2 as the data mart/dashboard backend for an application we are built. Its great that it has OAuth2 built in which makes it easy for us to allow SSO for a user. However is ...
user avatar
  • 121
1 vote
1 answer
13 views

Why can't I login to my wordpress at home?

I don't have the same issue in the office but when I try to login at home, it keeps on saying "too many redirects". I'm not very good at this FTP thing so can anyone help me what to do? I've tried ...
user avatar
  • 11
2 votes
0 answers
900 views

Apache basic authentication without instant prompt for credentials

I'm looking for away to eliminate the intrusive instant prompt for credentials when basic authentication is used and instead serve a nice page that tells the user where he is and what credentials to ...
user avatar
  • 216
0 votes
1 answer
30 views

PHP syntax issue [closed]

I'm reading a Sentry tutorial for implementing an authentication workflow in a webapp. I'm a PHP beginner. There's a thing I don't understand in this code: <?php // set up autoloader require ('...
user avatar
9 votes
0 answers
278 views

Automatic reauthenticate at oauth2 endpoint

I am currently (ab)using an oauth2 endpoint of an API to enable users of the API to login to my site (using response_type=code). I do not save refresh tokens or even access_token as that oauth2 ...
user avatar
3 votes
1 answer
354 views

Does requiring login to access content hinder SEO?

I am wondering what the SEO effects of a 'Login Wall' is. More specifically, we have content that is region specific, so for instance a URL could look like www.example.com/content/Canada/Ontario. This ...
user avatar
4 votes
2 answers
557 views

SEO Impact on presenting User details without login

I am looking to develop a functionality on our website in which i can a show user their name based on cookie data. There will be no login required. we will retrieve user's name based on the previous ...
user avatar
  • 41
3 votes
2 answers
1k views

Can basic HTTP password authentication interfere with CDN access?

I'm doing my best to ask this question, I'm stepping across domains here to cover for another team that is MIA on this task. Please guide me if the question sounds stupid. We are dealing with a ...
user avatar
  • 131