PHP_AUTH_USER not set?

Question

For some reason, none of the code within

if (isset($_SERVER['PHP_AUTH_USER']) &&
    isset($_SERVER['PHP_AUTH_PW']))
{

// When the above is set, the code that is here will execute of course

}

is being executed for me. When I enter the correct username and password, the prompt box for the authorization again pops up. Wouldn't both fields be 'set' if they are correct and I press enter? But for some reason that is not the case. What can I be doing wrong? Thank you.

Cordierite

Answer 1

There is a 'sensible way' to use HTTP Basic Auth in CGI-mode PHP: in the .htaccess use

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

and in the PHP use

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = 
  explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

Pickar

For some reason, on my server I had to use $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] – Pickar

This works but each page returns a 404 not found even though the page is displayed properly – Petrel

Sorry, I'd picked up the following rewrite from another page: RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L] and the trailing L was causing my 404 errors – Petrel

This worked for me with just the RewriteRule line in .htacess. I didn't have to make any changes to the PHP, and $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are now set. – Rightwards

github.com/symfony/symfony/blob/master/src/Symfony/Component/… – Isopiestic

The above didn't work for me but it might be due to my server set-up. On my Ubuntu 14.04 and ServerPilot set-up, I used the following in my .htccess file SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1. I can then access it using $_ENV['HTTP_AUTHORIZATION'] in PHP. – Cervantes

Can anyone explain the RewriteRule in this reply? It worked for me, but I actually do not understand it. :-) – Tello

try first to check if the $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] is set and not empty then you can use list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));, because some servers same in my case has REDIRECT_HTTP_AUTHORIZATION index and not HTTP_AUTHORIZATION so better set a full condition for both offsets. – Harslet

@JefferyThaGintoki This one only worked for 1and1 shared hosting server. – Krummhorn

There is a better answer below :) the one from @thePanz – Plunk

Answer 2

try this

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>

on your .htaccess file which you will have to place into the root directory

and then

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

in the begining of your php scripts

Blotto

@garyJ, It's the length of "basic " – Fermentative

can you explain to me why this line is needed in .htaccess? It worked for me – Cirilo

Answer 3

I am using Symfony 2.5.7 running on PHP-PFM + Apache 2.4 on Ubuntu 14.04. I have BASIC_AUTH working, it needs to correctly configure the Apache VirtualHost by adding:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

as also mentioned here.

Miniver

same here: PHP running in PHP-FPM mode, apache 2.4, centOS. I just had to add that line to my vhost config and it worked perfectly, with no changes on the PHP side – Cost

Answer 4

Starting from Apache 2.4.13, you simply need to use CGIPassAuth directive in your .htaccess:

CGIPassAuth On

Cloutman

this is the correct solution in my opinion, the others are workarounds – Gaudet

Best new feature, fixed me right up. – Aloise

Answer 5

According to phpinfo(), my server API is CGI/Fast CGI, so I've solved the problem by putting the following in my .htaccess file:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]

Narcolepsy

Answer 6

Try $_SERVER['REMOTE_USER']. This works for me on a PHP 5.3 CGI + Apache installation.

Antitoxin

Seems not to work under a Plesk installation with LAMP (sorry, I have no idea what version of Plesk this particular provider is using; Apache is the old 2.2 and PHP the even older 5.3.3). – Transfuse

Answer 7

If user access is granted giving username/password in URL please check if

AuthType Digest

is entitled in your VHost/Directory/.htaccess configuration.

This fixed it for my use case.

Kishke

Answer 8

On my host's servers, use $_SERVER['REDIRECT_REMOTE_USER'] instead of $_SERVER['PHP_AUTH_USER']

Contortionist