Implementing support for HTTP Digest Authorization in PHP
| From: | LacaK | Date: | Wed, 23 Mar 2005 07:44:14 +0000 |
| Subject: | Implementing support for HTTP Digest Authorization in PHP | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-15557@lists.php.net to get a copy of this message | ||
Hi everybody,
I am looking for somebody, who can implement HTTP Digest Authorization
in PHP.
A solution, that could be useful also for many PHP users. (is more
secure and so more usable than Basic authorization)
"HTTP Basic Authorization" sends password only base64 encoded, and may
be easily stolen.
but
"HTTP Digest Authorization" sends password 'md5 hashed', so for other
script it is much more harder to steal or gain it.
Wouldn´t it be possible to add in PHP support the Digest Authorization
for example in a form $_SERVER["PHP_AUTH_DIGEST"], where the header from
HTTP
Response would be added if 'Authorization: Digest ...' is used (similar
as the 'Authorization:
Basic ...' in $_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"] even
when safe_mode=On)
1.PHP must parse HTTP header.
2. When it finds Authorization: Basic then fill up
$_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"]
3. add next condition When it finds Authorization: Digest then fill
$_SERVER["PHP_AUTH_DIGEST"]
(I think, that it takes only few lines of source code . Modification in
init_request_info() function in mod_php4.c + ?)
I appended short file, where this modification is marked.
Thank you very much for your time and effort.
Please reply. Or advice me who I should contact.
Laco