HTTP Auth via PHP - PHP_AUTH_USER not set?

Question

I tried to implement a small authentication via http and copied this bit of code from the net to check whether this will work properly:

<?php
    if(!isset($_SERVER['PHP_AUTH_USER'])) {
        header('WWW-Authenticate: Basic realm="My Realm"');
        header('HTTP/1.0 401 Unauthorized');
        echo 'Text to send if user hits Cancel button';
        exit;
    } else {
        echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";
        echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>";
    }
?>

However, my browser always ask for a username and password but never outputs anything until i cancel. Therefore i think that $_SERVER['PHP_AUTH_USER'] is never set! What might be the problem? I am running Ubuntu 10.04 LTS Server with Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.7d DAV/2 Server.

@Jonny Keogh: Safari 5 and Firefox 5, however andreas already solved the problem by checking for CGI/FCGI. — Christian Ivicevic
– Christian Ivicevic, Commented Aug 13, 2011 at 21:23

Teddy · Accepted Answer · 2014-03-21 12:44:56Z

24

For PHP-CGI:

in .htaccess add this:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>

and at the beginning of your script add this:

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

edited Mar 21, 2014 at 12:44

answered Mar 21, 2014 at 8:48

Teddy

1,0421 gold badge13 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Reasurria Over a year ago

Praise the lord for your answer. I was sharpening my wrist slitting knife when this finally solved my problems.

Shawn Over a year ago

looks like you don't need this line:

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

Azmeer Over a year ago

@Shawn list($... is for the requesting client.

cdsaenz Over a year ago

The .htaccess fix is what worked for me. Notice I had to put it at the end of it, else my codeigniter installation wouldn't work

Andreas Wong · Accepted Answer · 2011-08-13 21:13:27Z

21

Run phpinfo(). if "Server API" is CGI/FCGI, you can pretty much forget it as there is no sensible way to use HTTP auth from PHP.

answered Aug 13, 2011 at 21:13

Andreas Wong

60.7k19 gold badges112 silver badges123 bronze badges

1 Comment

Erin Geyer Over a year ago

Actually, it will work with FastCGI. See my answer here: stackoverflow.com/a/56715271/1772821

Rohit Prajapati · Accepted Answer · 2019-09-19 08:56:40Z

0

Enable PHP-FPM and it will start working.

$valid_passwords = array ("test" => "test");
$valid_users = array_keys($valid_passwords);

$user = $_SERVER['PHP_AUTH_USER'];
$pass = $_SERVER['PHP_AUTH_PW'];

$validated = (in_array($user, $valid_users)) && ($pass == $valid_passwords[$user]);

if (!$validated) {
    header('WWW-Authenticate: Basic realm="Test"');
    header('HTTP/1.0 401 Unauthorized');
    die ("Not authorized");
}

answered Sep 19, 2019 at 8:56

Rohit Prajapati

111 bronze badge

Collectives™ on Stack Overflow

HTTP Auth via PHP - PHP_AUTH_USER not set?

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related