Hello,
I'm working with PHP and trying to protect my web page with an authentication header.
On my page I want protected I have the following code:
PHP Code:
<?php
require_once('authorize.php');
?>
This references my authorize.php file, which looks as follows:
PHP Code:
<?php
// User name and password for authentication
$username = 'user';
$password = 'pass';
if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW']) ||
($_SERVER['PHP_AUTH_USER'] != $username) || ($_SERVER['PHP_AUTH_PW'] != $password)) {
// The user name/password are incorrect so send the authentication headers
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Basic realm="Application"');
exit('<h2>Application Error</h2>Sorry, you must enter a valid user name and password to access this page.');
}
?>
Even when I use the correct username/password ('user' and 'pass'), the page just pops another log in box at me. I've double-checked my code and can't find any errors. Why is this happening?
Is there no way to fix this? I really need it to work for this application. I have double and triple-checked the code and can find NO reason for it to be doing this.
print_r($_SERVER) and scroll through the list. Does it include the PHP_AUTH_USER and PHP_AUTH_PW?
Also, make sure you move the header for the 401 before the WWW-Authenticate, and you may need to move that to a 1.0 instead of 1.1.
I think I've isolated the fact that the problem is somewhere in my web server's config files. I've looked about a bit on how to modify php.ini but as I'm not the only one on this server I definitely want to know what I'm doing before going ahead.
This hasn't a thing to do with PHP. The only thing it does is ask for the auth to be provided to it in the form of PHP_AUTH_USER, PHP_AUTH_PW, and potentially a digest.
Basic authentication is otherwise handled completely by Apache. That is why you are pushing the headers in PHP, not performing any work for it.
That would be modified in the httpd.conf, but now that I think of it that should only apply if you're using an htpasswd file which defeats the purpose of using PHP at all.
wait, are you on an IIS or Apache server? Run this and post the results, use whatever you want for the username and password, preferably something that doesn't authenticate:
PHP Code:
<?php
session_start();
if (!isset($_SESSION['hastried']))
{
$_SESSION['hastried'] = true;
header('HTTP/1.0 401 Unauthorized');
header('WWW-Authenticate: Basic realm="Log In"');
die('Log in required.');
}
If Apache is configured to use PHP as CGI/FastCGI the authentication variables will not be available. If you are on a shared server there is probably little to no chance that your provider will change that for you.
Only the native Apache handler for PHP is able to supply those variables for you.
__________________
Dave .... HostMonster for all of your hosting needs
@djm: I didn't understand your sentence, sorry. I am not on a shared server so much as I'm borrowing server space from a friend, thus I could possibly change things if I talked to him.
You can still make a CGI work, it just takes more hoops to jump through.
Modify an applied .htaccess file, or create a new one in your directory root and add this:
Code:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>
Next, modify your code and pull from the newly defined environment:
Before you post, read our: 
