Question

Greetings! All seems well except for one potential gotcha. Once I login and then return to TWiki.Main.WebHome the page still reads WelcomeGuest: ... instead of my login. Clue, please?

• TWiki version: 02 Dec 2000
• Web server: Apache
• Server OS: Linux

-- JoeDAndrea - 17 Jul 2001

Answer

I assume you're not on an SSL server, in which case the user authentication applies only to the commands listed in .htaccess: edit, preview, save, attach and upload. -- JonReid - 17 Jul 2001

Follow-up

Thanks! You nailed it: view is not among those commands with a "require valid-user."

Now for a really silly question ... SHOULD view be listed in this way or is this considered "a bad thing?" Put another way, wouldn't the whole idea of TWiki.Main.WebHome having that Welcome bit up front suggest that view should require a valid user?

I'm also making what may be an incorrect assumption ... that WebHome is supposed to show my login once I'm on.

Yet more suspicious funny-business: On the TWikiVariables page, USERNAME and TWIKIUSERNAME show up as guest and Main.TWikiGuest respectively ... even though I've already logged in. Yet on twiki.org, these variables display my login properly. Whee!

-- JoeDAndrea - 17 Jul 2001

Answer

Well twiki is mostly stateless TWIKIUSERNAME and USERNAME are only set to the appropriate user if these are known at the view script run time (if you are on an ssl link you can see what I mean by trying to edit any of these pages, and taking a look at the preview window, which requires a user identity).

Even under ssl, if the view script is not under Require valid-user, then your name will still be TwikiGuest. In my case, I have to satisfy either one of valid-user, or being in the internal network, so normally user identity is not required.

If you don't want this behavior then you have two alternatives:

1. Set view under Require valid-user , that way anybody trying to look at your twiki site will have to provide a password, so that the sytem knows who it is (there may be a catch-22 for anyone trying to register though!!!).
2. Set the preference variable $doRememberRemoteUser (in Twiki.cfg) to "1", that way the IP address will be associated with a particular user (I don't think this is recommended)

Probably the only sensible way of doing this would be to require the use of cookies, or at least some state information on the url query. There have been some discussions on this issue in the Codev web, you might want to search for "cookies" in there.

-- EdgarBrown - 17 Jul 2001