note 10539 deleted from features.http-auth by irc-html
| From: | irc-html@php.net | Date: | Sat, 19 Jan 2002 20:27:52 +0000 |
| Subject: | note 10539 deleted from features.http-auth by irc-html | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-25309@lists.php.net to get a copy of this message | ||
If you want to use HTTP Digest Authentication, these functions could help (PHP4):
function getHTTPheaders() {
//* get all HTTP headers
$headers = getallheaders();
//* set all header tags to lowercase
while (list($header, $value) = each($headers)) {
$header = strtolower($header);
$headers2[$header] = $value;
}
return $headers2;
} // function
function analyseHeaders(&$headers) {
//* filter authorization information
$authorization_param = $headers['authorization'];
if ($authorization_param != '') {
$pos = strpos($authorization_param, ' ');
$delivered_auth_type = strtolower(substr($authorization_param, 0, $pos));
$authorization_params = substr($authorization_param, $pos+1);
//* analyse parameters
if ($delivered_auth_type == 'basic') {
list($loginname, $password) = explode(':',
base64_decode($authorization_params));
$params['authorization_type'] = 'basic';
$params['username'] = $loginname;
$params['password'] = $password;
} else if ($delivered_auth_type == 'digest') {
$params['authorization_type'] = 'digest';
$digest_params_tmp = explode(',', $authorization_params);
while ($digest_param = each($digest_params_tmp)) {
$tmp = trim($digest_param[1]);
list($tag, $value) = explode('=', $tmp);
if ($value[0] == '"') $value = substr($value, 1);
$len = strlen($value);
if ($value[$len-1] == '"') $value = substr($value, 0, $len-1);
$params[strtolower($tag)] = $value;
}
}
}
}
function requestDigestAuthentication($realm, $domain, $nonce, $opaque) {
header('WWW-Authenticate: Digest '.
"realm=\"$realm\", ".
"domain=\"$domain\", ".
"nonce=\"$nonce\", ".
"opaque=\"$opaque\", ".
'qop="auth,auth-int"');
} // function
...
$db_password = 'localpasswordoutofdatabase'; // is plain text, but other system would be
safer
$our_response = md5( md5("$username:$realm:$db_password").
":$db_nonce:$nc:$cnonce:$qop:".
md5("{$HTTP_SERVER_VARS['REQUEST_METHOD']}:{$HTTP_SERVER_VARS['REQUEST_URI']}"));
/*
Note: see ftp://ftp.isi.edu/in-notes/rfc2617.txt for more
info
Note: This code is just a sample, not a full working program !!!
*/