.htpassword password expiration?

[Mornincupofhate]

So I'm working on an automated subscription system, and I have the passwords and authentication working and everything, but is there a way to make the certain credentials expire after a certain amount of time? 

[Hazy125]

It's not easy since the htaccess stuff is cached by the client. One method is to use the expires meta tag, however this will forgo caching on the entire site, meaning your script and images files will also be not cached

 

<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT">

 

[Mornincupofhate]

1 minute ago, Hazy125 said:

It's not easy since the htaccess stuff is cached by the client. One method is to use the expires meta tag, however this will forgo caching on the entire site, meaning your script and images files will also be not cached

 

<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT">

 

Literally have never touched .htaccess before besides today.

Mind telling me where to put this?

[Hazy125]

I don't blame you. htaccess does my head in, meta tags go in a HTML document 

[Mornincupofhate]

1 minute ago, Hazy125 said:

I don't blame you. htaccess does my head in, meta tags go in a HTML document 

Thanks, but still confused.

If I'm going to have multiple username/password sets for multiple people, how would I set this up?

[Mornincupofhate]

8 minutes ago, Hazy125 said:

I don't blame you. htaccess does my head in, meta tags go in a HTML document 

Just to make sure we're on the same page, we're talking about removing the username/password fully from the .htpasswd file after a given time, and not just cookie expiration, correct?

[Hazy125]

Yeah, the problem is that you can't actually reliably do it. Forcing a browser cache clear will work. So, you would put that meta tag on the page that is shown upon HTTP authentication. You might also have success by directing the user to fakeusernamethatnoonewillhave@yourdomain.com but that isn't supported and can produce errors on some browsers 

[Mornincupofhate]

1 minute ago, Hazy125 said:

Yeah, the problem is that you can't actually reliably do it. Forcing a browser cache clear will work. So, you would put that meta tag on the page that is shown upon HTTP authentication. You might also have success by directing the user to fakeusernamethatnoonewillhave@yourdomain.com but that isn't supported and can produce errors on some browsers 

Damn, I suppose I would have more luck having someone write me a php program that automatically rewrites the file every x days?

[Hazy125]

I would suggest using a typical PHP based login system unless you absolutely need to login via HTTP...