note 100887 added to features.http-auth

Neverending story CGI... I' m running into some serious problems when trying to get http digest auth to work with PHP as CGI. The general problem: ====================== ====================== When PHP runs as CGI, the $_SERVER['PHP_AUTH_USER'] won't be set. This causes that no credentials can be validated, not matter what is entered as username and password. Solutions: ====================== ====================== #1 create an .htaccess file like this: ====================== RewriteEngine on RewriteCond %{HTTP:Authorization} !^$ RewriteRule .* - [E=PHP_AUTH_USER:%{HTTP:Authorization},L] This "should" create the $_SERVER['PHP_AUTH_USER'] variable. However, this did NOT work for me, maybe due to some stupid restrictions or whatever. #2 create an .htaccess file like this: ====================== Options FollowSymLinks RewriteEngine on RewriteCond %{HTTP:Authorization} !^$ RewriteRule ^(.*)$ index.php?PHP_AUTH_DIGEST=%{HTTP:Authorization} In your PHP script add these lines: <?php if (empty($_SERVER['PHP_AUTH_DIGEST']) && !empty($_GET['PHP_AUTH_DIGEST'])){ $_SERVER['PHP_AUTH_DIGEST'] = stripslashes(substr($_GET['PHP_AUTH_DIGEST'],7)); } ?> The htacces will create a GET variable cotaining the stuff that used to be in $_SERVER['PHP_AUTH_USER']. It has to be adjusted by removing the first 7 chars (it starts with "Digest " for some strange reason...) and by removing slashes before double quotes (this might depend on some settings like magic_quotes, not sure...). This solution works as long as you do not need to pass any GET parameters. If you DO pass them, you woud have to change the Rewrite rule to: RewriteRule ^(.*)$ index.php?PHP_AUTH_DIGEST=%{HTTP:Authorization} [QSA] QSA appends the query String (otherwise it would be overwritten). BUT there is a parameter in the PHP_AUTH_DIGEST called "uri" which cotains the currently called URI. This will contain GET parameters which whill break the PHP_AUTH_DIGEST string at this point and your credentials cannot be validated any longer. I spend several hours trying every freakin' hack to get this to work.. it's devistating -_- Bottom Line ====================== ====================== I'm sorry I don't have a full working solution so far. You could user Whatabrains solution which is based on #2 solution above: #3 (by Whatabrain) ====================== My solution is pretty round-about, but it works: RewriteEngine on RewriteCond %{HTTP:Authorization} !^$ RewriteCond %{REQUEST_METHOD} =GET RewriteCond %{QUERY_STRING} ="" RewriteRule ^page.php$ page.php?login=%{HTTP:Authorization}$1 This causes the Auth string to be added to the URL if there are no parameters and it's a GET request. This prevents POSTs and parameter lists from being corrupted. Then, in the PHP script, I store the Auth string as a session cookie. So the only way to log in to my script is to go to the url with no parameters. ====================== This might work, but its deeply hacky and I cannot imagine that there is no other way to solve this problem. It's clearly a bug in my opinion. Hope this can save you some time... Cheers Pascal http://www.mywebsolution.de/ ---- Server IP: 69.147.83.197 Probable Submitter: 129.13.72.197 ---- Manual Page -- http://www.php.net/manual/en/features.http-auth.php Edit -- https://master.php.net/note/edit/100887 Del: integrated -- https://master.php.net/note/delete/100887/integrated Del: useless -- https://master.php.net/note/delete/100887/useless Del: bad code -- https://master.php.net/note/delete/100887/bad+code Del: spam -- https://master.php.net/note/delete/100887/spam Del: non-english -- https://master.php.net/note/delete/100887/non-english Del: in docs -- https://master.php.net/note/delete/100887/in+docs Del: other reasons-- https://master.php.net/note/delete/100887 Reject -- https://master.php.net/note/reject/100887 Search -- https://master.php.net/manage/user-notes.php