CURL HTTP Authentication at server side

Question

I am building a web service with Zend and i have to authenticate the users before sending them response. The user will send a request to a server page, using curl, passing his credentials in the form of curl_setopt($curl, CURLOPT_USERPWD, 'key:pass');

Iam using Zend framework and so the server side page is denoted like:

http://www.example.com/app_name/public/controller/action/parameter

Here is the total code for user's request (client.php):

<?php
$curl = curl_init('http://www.example.com/app/public/user/add/1');

curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);                         
curl_setopt($curl, CURLOPT_USERPWD, 'username:password');
curl_setopt($curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY);                    
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);                          
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);                           
curl_setopt($curl, CURLOPT_USERAGENT, 'Sample Code');

$response = curl_exec($curl);                                          
$resultStatus = curl_getinfo($curl);                                   

if($resultStatus['http_code'] == 200) {
    echo $response;
} else {
    echo 'Call Failed '.print_r($resultStatus);                         
}

?>

Now what i want is that, i must be able to retrieve the username and password at the server side (in my zend controller), so that i can verify the user credentials from database and send the response accordingly. So how can i do authentication in another page?

Well, i have been using CURLOPT_HTTPHEADER for sending the params in header and iam able to retrieve them in the controller, like: $request->getHeader('param'); — shasi kanth
– shasi kanth, Commented Feb 11, 2011 at 13:18

Gordon · Accepted Answer · 2011-02-10 13:22:59Z

9

Zend Framework has a ready-made component for handling HTTP authentication.

Checkout the examples at

http://framework.zend.com/manual/en/zend.auth.adapter.http.html

If you don't want to use that, you can still go the "old-school" way, as described in

http://php.net/manual/en/features.http-auth.php

and manually check on $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW']

answered Feb 10, 2011 at 13:22

Gordon

318k76 gold badges548 silver badges566 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

shasi kanth Over a year ago

but, for the second case, as i said in the below comment, iam not getting those variables in the $_SERVER array. They appear only if the target page is a php file, which exists in the root directory.

Gordon Over a year ago

@dskanth depending on what authentication negotiated, you might have Digest authentication. See the second example in the PHP Manual and verify whether you have PHP_AUTH_DIGEST set

shasi kanth Over a year ago

Oh... yes, i have PHP_AUTH_DIGEST set, how can i modify this example to validate the credentials at the server side?

Gordon Over a year ago

@dskanth the example already does what you are asking for. I suggest you either read up on the used functions in the example or use the Zend_Auth component.

Linus Kleen · Accepted Answer · 2018-06-27 17:18:29Z

6

You need to set CURLOPT_HTTPAUTH to CURLAUTH_BASIC.

That way, in the target script, PHP_AUTH_USER and PHP_AUTH_PW (plain text) will be available.

Calling script:

<?php
$ch = curl_init('https://localhost/target.php');
// ...
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_exec($ch);
?>

In target.php:

$user = $_SERVER['PHP_AUTH_USER'];
$pass = $_SERVER['PHP_AUTH_PW'];

I suggest executing the cURL request over HTTPS since username and password are transmitted plain text.

edited Jun 27, 2018 at 17:18

answered Feb 10, 2011 at 12:30

Linus Kleen

34.8k10 gold badges97 silver badges100 bronze badges

5 Comments

shasi kanth Over a year ago

Iam able to get those values only if i give the target file as .php, which is located inside the root directory. But iam using zend and the target file is a controller file with an action, that takes a parameter. I have edited the question with more information.

shasi kanth Over a year ago

Iam also able to get those values in $_SERVER array, if iam not using zend framework, and specify my curl url something like: localhost/pt1/public/api/v1/target.php, which is not part of zend application, and which is just a folder hierarchy. But how do i do it with zend controller and action?

Linus Kleen Over a year ago

I'm sorry, @dskanth. I have no idea. Me and Zend Framework aren't particular friends.

mikiqex Over a year ago

Correction: $pass = $_SERVER['PHP_AUTH_PW'];, see php.net/manual/en/features.http-auth.php

Linus Kleen Over a year ago

@mikiqex Thanks for pointing that out. I corrected the answer accordingly.

Andrew Barber · Accepted Answer · 2013-03-01 10:51:21Z

1

you can send username and password as post fields

$post_data = $user.":".$pass
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);

you can get the credentials using $_POST

edited Mar 1, 2013 at 10:51

Andrew Barber

40.3k20 gold badges97 silver badges124 bronze badges

answered Mar 1, 2013 at 10:47

aruna

111 bronze badge

Collectives™ on Stack Overflow

CURL HTTP Authentication at server side

3 Answers 3

4 Comments

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related