Edit report at https://bugs.php.net/bug.php?id=70101&edit=1
ID: 70101
Comment by: dougk dot ff7 at gmail dot com
Reported by: roeycohen at gmail dot com
Summary: curl with digest authentication does work (all the
time)
Status: Open
Type: Bug
Package: cURL related
Operating System: windows and linux
PHP Version: 5.6.11
Block user comment: N
Private report: N
New Comment:
On Windows specifically, this seems to be related to the change to using SSPI with cURL.
curl_sasl_sspi.c adds "Curl_override_sspi_http_realm()" in curl-7.43.0. Going all the way
back to php-5.3.29 works (php-5.4 through php-5.5 crash due to the aforementioned bug). Building my
own version of cURL based on 7.43.0 (from [1]) and building it into php-5.6.14 manually works as
expected.
Note that this only explains the Windows case of this issue (where Realm is sent back to the server
as an empty string). This can be verified using CURLOPT_VERBOSE = true.
[1] https://github.com/winlibs/cURL
Previous Comments:
------------------------------------------------------------------------
[2015-08-10 10:06:48] luca dot horn at gmail dot com
I am experiencing same problem on PHP 5.6.12 x86, cURL 7.42.1, Windows 8.1 x64.
It instead seems to work as expected on my Ubuntu machine (running PHP 5.6.11 and cURL 7.35.0).
------------------------------------------------------------------------
[2015-07-20 10:57:04] roeycohen at gmail dot com
according to phpinfo(), i have curl version 7.42.1.
i am using php 5.6.11 downloaded from here:
http://windows.php.net/downloads/releases/php-5.6.11-nts-Win32-VC11-x86.zip
------------------------------------------------------------------------
[2015-07-20 10:51:47] laruence@php.net
which version of lib curl do you use?
I can not reproduce this error(it works fine with lib curl 7.22.0) here
------------------------------------------------------------------------
[2015-07-19 09:51:02] roeycohen at gmail dot com
Description:
------------
trying to use curl_exec with digest authentication does not work properly.
running the test script always fails to pass the security challenge.
using the browser or wget directly works perfectly.
also, trying to run the same test on another server of mine, works from an amazon linux with php
5.5.21 but does not work from my windows 7 x64 machine with php 5.6.11.
trying to run the test with php 5.5 or 5.4 using CLI on several windows machines caused a complete
crush of the php executable.
it seems like bug #69088 is related, but this bug also happens on linux (5.5).
Test script:
---------------
<?
$curl = curl_init();
$curl_options = [
CURLOPT_HTTPAUTH => CURLAUTH_ANY,
CURLOPT_USERPWD => 'test_user:password',
CURLOPT_URL => 'http://test_user:password@httpbin.org/digest-auth/auth/user/password',
CURLOPT_HEADER => true,
];
curl_setopt_array($curl, $curl_options);
curl_exec($curl);
curl_close($curl);
Expected result:
----------------
{
"authenticated": true,
"user": "user"
}
Actual result:
--------------
"Authentication failed" (with header 401)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=70101&edit=1