PHP: calling an API protected using basic authentication

Question

I have an API deployed on a server that's now protected using basic authentication.

I also have a script running on the SAME server that the APi running on, that needs to call the API.

script: test.php

<?php
$url = 'https://my_site.myapi/account/add/{"account_id":"1234555"}
$username = 'myname';
$password = 'mypassword';
$ch=curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_USERPWD, $username.":".$password);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,5);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
$data = curl_exec($ch);
curl_close($ch);

When I try calling test.php from a browser:

https://my_site.myapi/test.php

I am promoted for user name and password. I am not getting an error message. Any ideas?

VirtualHost Section

DocumentRoot /var/www/mysite/web/
<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>

<Directory "/var/www/api_section_1">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
    AuthType Basic
    AuthName "Restricted Access"
    AuthUserFile /usr/local/apache/passwd/passwords
</Directory>

Alias /winapi /var/www/another_section/
<Directory "/var/www/another_section">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
    AuthType Basic
    AuthName "Restricted Access"
    AuthUserFile /usr/local/apache/passwd/passwords
</Directory>

dearlbry · Accepted Answer · 2012-11-14 20:34:12Z

1

If you're getting prompted for a password, that's not coming from your curl call, but rather apache. My guess is that your https://my_site.myapi/test.php page is also mistakenly protected by the basic auth.

curl_exec() would return an error indicating that authentication was required, not prompt you for it.

answered Nov 14, 2012 at 20:34

dearlbry

3,2212 gold badges25 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

dearlbry Over a year ago

@EastsideDeveloper I assume you've restarted Apache after making these changes? Does it prompt for credentials for other scripts in that same directory?

EastsideDev Over a year ago

Yes, I restarted Apache. I deleted the passwords files and re-created it. That solved the problem.

EastsideDev Over a year ago

But, I also initially had the main document directory protected (that's in addition to the corrupt passwords file)

Fenton · Accepted Answer · 2012-11-14 19:46:00Z

0

Is your basic authentication expecting any encoding - for example the username and password token may need to be base64 encoded.

Another thing to check is that the details make it into the Authorization header - check the request headers to see if this is the case.

answered Nov 14, 2012 at 19:46

Fenton

253k74 gold badges404 silver badges414 bronze badges

2 Comments

EastsideDev Over a year ago

I tried it with and without base64 encoding. I thought that the point of using cUrl is that I did not need to send an Authorization header

Fenton Over a year ago

I would imagine that curl abstracts you from setting it, but sets it based on the curl options you pass. You need to check the actual request headers to see what is really sending.

Collectives™ on Stack Overflow

PHP: calling an API protected using basic authentication

VirtualHost Section

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

VirtualHost Section

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related