[Xitami] Password problems

[Ewen McNeill]

In message <002801c0f9f3$b389de20$830a5f82@hm.uwa.edu.au>, "Don Gordon" writes:
>Let's hope this info is of some use.
>
>Access.log (Nescape) - both RA files play.
>
>130.95.10.132 - test [21/Jun/2001:08:58:49 +0800] "GET /test/Sounds/L01-08.rpm HTTP/1.0" 304 0
>130.95.10.132 - test [21/Jun/2001:08:58:49 +0800] "GET /test/Movies/L01s08-1.rpm HTTP/1.0" 304 0
>130.95.10.132 - test [21/Jun/2001:08:58:49 +0800] "GET /test/Movies/L01s08-1.rpm HTTP/1.0" 304 0
>
>Access.log (IE) - soud played ok, movie didn't (200 code, not 304).
>
>130.95.10.132 - test [21/Jun/2001:08:56:07 +0800] "GET /test/Sounds/L01-08.ra HTTP/1.1" 304 0
>130.95.10.132 - test [21/Jun/2001:08:56:07 +0800] "GET /test/Sounds/L01-08.ra HTTP/1.1" 304 0
>130.95.10.132 - test [21/Jun/2001:08:56:07 +0800] "GET /test/Movies/L01s08-1.ra HTTP/1.1" 200 191945
>130.95.10.132 - test [21/Jun/2001:08:56:07 +0800] "GET /test/Movies/L01s08-1.ra HTTP/1.1" 200 191945

This is just strange.  304 is "not modified" which means "the copy
you've already got is up to date, you can use that"; 200 is "found" and
means "here you go, here's a copy of the thing you requested".

In _both_ cases it should play just fine, as both bits of audio are
available without apparent problems.

What I'm really puzzled about is IE getting a 304 return on both files
(ie, being told the local copies are fine), and then deciding it needs
to get a copy of them _anyway_.  It almost looks like IE doesn't believe
the webserver when it says the existing files are okay!

I see you're using IE 5.0: is this the 5.0 with the security problems,
or the 5.01 fixed version (I don't know if they report different
User-Agent headings).  In either case I would expect it to work, but
apparently it isn't working "as expected".

>I have had a look at Paul Reid's site which works fine with multiple RA 
>files and password. The difference is that my RA files are embedded 
>which seems to cause the problem in IE. This problem is starting to look 
>like a too hard basket case. Any further advice would be gratefully 
>accepted.

One thing you might want to consider if it's causing you a lot of pain
is "security through obscurity" -- put the RA files in a non-password
protected directory, and just only link to them from your hidden page.
Obviously anyone who knew the URL would then be able to get the RA
files, but hopefully IE will then manage to cope.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com