Implementing support for HTTP Digest Authorization in PHP

From: Date: Wed, 23 Mar 2005 07:44:14 +0000
Subject: Implementing support for HTTP Digest Authorization in PHP
Groups: php.internals 
Request: Send a blank email to internals+get-15557@lists.php.net to get a copy of this message
Hi everybody, I am looking for somebody, who can implement HTTP Digest Authorization in PHP. A solution, that could be useful also for many PHP users. (is more secure and so more usable than Basic authorization) "HTTP Basic Authorization" sends password only base64 encoded, and may be easily stolen. but "HTTP Digest Authorization" sends password 'md5 hashed', so for other script it is much more harder to steal or gain it. Wouldn´t it be possible to add in PHP support the Digest Authorization for example in a form $_SERVER["PHP_AUTH_DIGEST"], where the header from HTTP Response would be added if 'Authorization: Digest ...' is used (similar as the 'Authorization: Basic ...' in $_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"] even when safe_mode=On) 1.PHP must parse HTTP header. 2. When it finds Authorization: Basic then fill up $_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"] 3. add next condition When it finds Authorization: Digest then fill $_SERVER["PHP_AUTH_DIGEST"] (I think, that it takes only few lines of source code . Modification in init_request_info() function in mod_php4.c + ?) I appended short file, where this modification is marked. Thank you very much for your time and effort. Please reply. Or advice me who I should contact. Laco

« previous php.internals (#15557) next »