Login/Register
How can I use Basic HTTP Authentication in PHP?
Asked Answered
Solved phpauthenticationhttp-authenticationbasic-authenticationserver-variables
I

6

23

I'm trying to use Basic HTTP Authentication and followed the example on the PHP manual page. But it doesn't work for me. The variable $_SERVER['PHP_AUTH_USER'] doesn't seem to be set. When a user try to log in, the user is prompted whith a new login-dialog. The server is running PHP 5.3.3 and I have tried with Google Chrome and Internet Explorer.

Here is the simple example that I used:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="Jonas Realm"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'User pressed Cancel';
    exit;
} else {
    echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";
    echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as you password.</p>";
}
?>

What is wrong? How can I use Basic HTTP Authentication in PHP?

Internode answered 11/11, 2010 at 0:43 Comment(7)
Rather than trying to do this with PHP, why don't you use the web server, eg httpd.apache.org/docs/2.2/howto/auth.html – Nimble
@James: I think my web host uses Apache. – Internode
@Phil: Then will my PHP code be denpendent of my web server, and I can't easyli change to another web server. I would like to follow the HTTP standard. – Internode
Unauthorized is misspelled, first. Your example is shorter than the link you referenced. – Pave
@James: Thanks, but it didn't help. – Internode
@Internode Fair enough, it's just so easy using htpasswd :) – Nimble
Have you read through the comments on the link you followed? There are suggestions for different web servers and several versions of the program, one of these may work better for your needs. For PHP I find the manual comments to be more useful than the description in the manual. – Pave
M
11

How is PHP being run? If it's through Apache mod_cgi, I'm afraid you cannot get hold of the authentication information at all. Apache won't pass it to CGI apps unless you compile it with the SECURITY_HOLE_PASS_AUTHORIZATION flag. (Whether it's actually a security hole or not depends on whether other users on your server have a lower or greater privilege than your website users.)

If it's IIS CGI, you have to ensure that only ‘Anonymous’ directory access is configured, or IIS will try to step in and authenticate credentials itself.

echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";

HTML-injection security hole (well, if it worked). Use htmlspecialchars(). Man, is that PHP doc page full of highly questionable advice and code.

You can try to look at $_SERVER['HTTP_AUTHORIZATION'] as well, though I suspect it's the mod_cgi issue in which case neither variable will be present and you will have to resort to cookie-based login instead. Or change to a host with a more modern approach to PHP hosting, such as FastCGI or mod_php.

Mukerji answered 11/11, 2010 at 1:14 Comment(0)
T
19

Try this::

<?php
    /*
    ** Define a couple of functions for
    ** starting and ending an HTML document
    */
    function startPage()
    {
        print("<html>\n");
        print("<head>\n");
        print("<title>Listing 24-1</title>\n");
        print("</head>\n");
        print("<body>\n");
    }

    function endPage()
    {
        print("</body>\n");
        print("</html>\n");
    }
    /*
    ** test for username/password
    */
    if( ( isset($_SERVER['PHP_AUTH_USER'] ) && ( $_SERVER['PHP_AUTH_USER'] == "leon" ) ) AND
      ( isset($_SERVER['PHP_AUTH_PW'] ) && ( $_SERVER['PHP_AUTH_PW'] == "secret" )) )
    {
        startPage();

        print("You have logged in successfully!<br>\n");

        endPage();
    }
    else
    {
        //Send headers to cause a browser to request
        //username and password from user
        header("WWW-Authenticate: " .
            "Basic realm=\"Leon's Protected Area\"");
        header("HTTP/1.0 401 Unauthorized");

        //Show failure text, which browsers usually
        //show only after several failed attempts
        print("This page is protected by HTTP " .
            "Authentication.<br>\nUse <b>leon</b> " .
            "for the username, and <b>secret</b> " .
            "for the password.<br>\n");
    }
?>
Takakotakakura answered 2/1, 2011 at 10:9 Comment(0)
C
13

For PHP-CGI:

in .htaccess add this:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>

and at the beginning of your script add this:

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
Custodian answered 21/3, 2014 at 12:49 Comment(2)
That substr() is suspicious. I would first break the string at the first space and make sure the type of authentication is indeed set to Basic (ignoring case). Then get the second part and decode it. – Lucifer
How can I implement auto login? I have added above code but I am bit confused where to start in my application – Oozy
M
11

How is PHP being run? If it's through Apache mod_cgi, I'm afraid you cannot get hold of the authentication information at all. Apache won't pass it to CGI apps unless you compile it with the SECURITY_HOLE_PASS_AUTHORIZATION flag. (Whether it's actually a security hole or not depends on whether other users on your server have a lower or greater privilege than your website users.)

If it's IIS CGI, you have to ensure that only ‘Anonymous’ directory access is configured, or IIS will try to step in and authenticate credentials itself.

echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";

HTML-injection security hole (well, if it worked). Use htmlspecialchars(). Man, is that PHP doc page full of highly questionable advice and code.

You can try to look at $_SERVER['HTTP_AUTHORIZATION'] as well, though I suspect it's the mod_cgi issue in which case neither variable will be present and you will have to resort to cookie-based login instead. Or change to a host with a more modern approach to PHP hosting, such as FastCGI or mod_php.

Mukerji answered 11/11, 2010 at 1:14 Comment(0)
M
1

I think the PHP methods rely on Basic Authentication being configured on the Web Server. An easy way to do this is to include a .htaccess file in the directory you want to enable basic authentication for.

Most unix-based web hosts allow you to do this by just uploading this file. A separate file (call this .htauth) will hold the user logins that are allowed to access the site or directory.

Menstruation answered 11/11, 2010 at 0:57 Comment(2)
That's incorrect. PHP can completely control the headers sent to the client (browser). – Nimble
@phil not true. Apache always sends a "Server:" header and PHP cannot prevent that. – Tensor
W
0

Check if you have overrided your variable $_SERVER[‘PHP_AUTH_USER’] and$_SERVER[‘PHP_AUTH_PW’] before the place where you are trying to access the both variables.

If above is not the case then chek if you are using php as cgi mod or not. IF you are using php as cgi mod then in the most of case you will not get $_SERVER[‘PHP_AUTH_USER’] and$_SERVER[‘PHP_AUTH_PW’] because generraly we do not compile the apache with option SECURITY_HOLE_PASS_AUTHORIZATION So if you want to get both variable then re-compile apache with option SECURITY_HOLE_PASS_AUTHORIZATION or you can use .htaccess approach.

Waggish answered 28/1, 2017 at 7:19 Comment(0)
S
0

If you don't have PHP_AUTH_USER and PHP_AUTH_PW in your $_SERVER variables you need to check PHP_AUTH_DIGEST as described here: https://www.php.net/manual/en/features.http-auth.php

Check example #2.

Silveira answered 7/11, 2023 at 13:35 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.