basic authentication usage
| From: | Jim Giner | Date: | Mon, 10 Jun 2013 20:28:10 +0000 |
| Subject: | basic authentication usage | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-321363@lists.php.net to get a copy of this message | ||
Trying to learn how this works for a simple security need I have. Nothing serious, hence this experiment.
My code:
if (!isset($_SERVER['PHP_AUTH_USER']))
{
header('WWW-Authenticate: Basic realm="My Realm"');
header('HTTP/1.0 401 Unauthorized');
echo '<h3>You have chosen not to signin<br><br>';
echo "Click <a href='/index.php'>here</a> to go back to the menu";
unset($_SERVER['PHP_AUTH_USER']);
unset($_SERVER['PHP_AUTH_PW']);
unset($_ENV['PHP_AUTH_USER']);
unset($_ENV['PHP_AUTH_PW']);
exit;
}
else
{
echo "checking creds<br>";
if ($_SERVER['PHP_AUTH_USER'] <> "validuser")
{
unset($_SERVER['PHP_AUTH_USER']);
unset($_SERVER['PHP_AUTH_PW']);
unset($_ENV['PHP_AUTH_USER']);
unset($_ENV['PHP_AUTH_PW']);
echo '<h3>You have entered invalid information.<br><br>';
echo "Click <a href='/index.php'>here</a> to go back to the menu";
exit();
}
}
(if we get here we have signed on)
(....continue on with script)
*******
My problem is trying to remove the invalid credentials (unsets) so that when the user attempts to access the page again, the signin dialog gets displayed. On my second attempt I always get the "invalid" path and never get a chance to re-enter the credentials.
What am I missing (besides it's a lousy security solution)?
Can one NOT unset a SERVER variable? How does one get around that in this case if so?