Edit report at https://bugs.php.net/bug.php?id=70101&edit=1
ID: 70101
Updated by: cmb@php.net
Reported by: roeycohen at gmail dot com
Summary: curl with digest authentication does work (all the
time)
-Status: Open
+Status: Feedback
Type: Bug
Package: cURL related
Operating System: windows and linux
PHP Version: 5.6.11
-Assigned To:
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
The given test script works as expected for me with PHP-7.3 using
7.67.0. Can anybody else still reproduce the reported issue with
any of the supported PHP versions[1] using a somewhat recent
libcurl?
[1] <https://www.php.net/supported-versions.php>
Previous Comments:
------------------------------------------------------------------------
[2017-07-01 07:56:17] gohel at basicguru dot de
I am experiencing same problem now on PHP 7.0.20 x86, Windows x64.
It instead to work as expected on the same PHP installation, but with the Curl-Lib from PHP 7.0.14.
------------------------------------------------------------------------
[2015-12-28 16:33:14] gohel at basicguru dot de
I have the same problem with PHP-clients/scripts and the CalDAV/SabreDAV-framework (also included in
Owncloud, Baikal, etc.) on my Apache 2.4.17 (Win32/VC11 from Apachelounge on Win7/64).
I've played a little bit with different versions of the PHP 5.6.x releases and found the
following:
php_curl.dll <= v5.6.4 - no problems
php_curl.dll v5.6.5/v5.6.6 - crash with Auth_Digest
php_curl.dll => v5.6.7 - Auth_Digest failed
The bug is also in the PHP 5.5 release and PHP 5.4 (last stable PHP_CURL.DLL I've found in
v5.4.36)
------------------------------------------------------------------------
[2015-10-26 17:37:47] dougk dot ff7 at gmail dot com
One last post, with working httpbin.org support (note that they test for the presence of a fake
cookie -- instead of setting up a cookie jar, I've just passed back the fake cookie):
<?php
$curl = curl_init();
$curl_options = [
CURLOPT_HTTPAUTH => CURLAUTH_ANY,
CURLOPT_USERPWD => 'user:passwd',
CURLOPT_URL => 'http://httpbin.org/digest-auth/auth/user/passwd',
CURLOPT_HEADER => true,
CURLOPT_VERBOSE => true,
CURLOPT_COOKIE => 'fake=fake_value'
];
curl_setopt_array($curl, $curl_options);
curl_exec($curl);
curl_close($curl);
?>
------------------------------------------------------------------------
[2015-10-26 16:46:56] dougk dot ff7 at gmail dot com
One other note: it seems curl in general is having issues with httpbin's digest test service (I
have the same issues with both curl and wget on the command line)... this one seems to work fine
(hosted by webdav.org), though it returns a 404:
<?php
$curl = curl_init();
$curl_options = [
CURLOPT_HTTPAUTH => CURLAUTH_ANY,
#CURLOPT_USERPWD => 'user:passwd',
#CURLOPT_URL => 'http://httpbin.org/digest-auth/auth/user/passwd',
CURLOPT_USERPWD => 'user1:user1',
CURLOPT_URL => 'http://test.webdav.org/auth-digest',
CURLOPT_HEADER => true,
CURLOPT_VERBOSE => true
];
curl_setopt_array($curl, $curl_options);
curl_exec($curl);
curl_close($curl);
?>
------------------------------------------------------------------------
[2015-10-26 16:21:32] dougk dot ff7 at gmail dot com
On Windows specifically, this seems to be related to the change to using SSPI with cURL.
curl_sasl_sspi.c adds "Curl_override_sspi_http_realm()" in curl-7.43.0. Going all the way
back to php-5.3.29 works (php-5.4 through php-5.5 crash due to the aforementioned bug). Building my
own version of cURL based on 7.43.0 (from [1]) and building it into php-5.6.14 manually works as
expected.
Note that this only explains the Windows case of this issue (where Realm is sent back to the server
as an empty string). This can be verified using CURLOPT_VERBOSE = true.
[1] https://github.com/winlibs/cURL
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=70101
--
Edit this bug report at https://bugs.php.net/bug.php?id=70101&edit=1