{"id":2449,"date":"2009-08-09T23:11:59","date_gmt":"2009-08-09T21:11:59","guid":{"rendered":"http:\/\/localhost\/helpcentre\/?p=2449"},"modified":"2022-11-10T12:19:48","modified_gmt":"2022-11-10T10:19:48","slug":"php_auth-fastcgi","status":"publish","type":"post","link":"https:\/\/xneelo.co.za\/help-centre\/website\/php_auth-fastcgi\/","title":{"rendered":"How to pass authentication headers in PHP on a Fast-CGI enabled server"},"content":{"rendered":"

When using Fast-CGI<\/b> to pass authentication headers, these headers are passed to the script however they are ignored by PHP. This is because only the \u201cHTTP_AUTHORIZATION\u201d environmental variable gets checked while the \u201cAuthorization\u201d variable is ignored. The following steps can be used to overcome this problem:
\nCreate a .htaccess file in the root directory of the script\/application you are using:<\/p>\n


\nRewriteEngine onRewriteRule <\/span>.* - <\/span>[E<\/span>=<\/span>HTTP_AUTHORIZATION<\/span>:%
\n<\/span>{HTTP<\/span>:<\/span>Authorization}<\/span>,<\/span>L]<\/span>. <\/span>
\n<\/span>
\n<\/code><\/div>\n

Next you need to change all the PHP_AUTH_USER and PHP_AUTH_PW variables in your web content to<\/p>\n


\n$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>] <\/span>and
\n<\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>] <\/span>
\n<\/span>
\n<\/code><\/div>\n

.<\/p>\n

Finally you will need to add the following lines of code preceding the authentication code used in your application \/ script:<\/p>\n


\n:if(<\/span>preg_match<\/span>(<\/span>'\/Basic+(.*)$\/i'<\/span>,&<\/span>nbsp<\/span>;&<\/span>nbsp<\/span>;
\n<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>,
\n<\/span>$matches<\/span>))
\n<\/span>{
\n<\/span>list(<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>]<\/span>,
\n<\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>]<\/span>) = <\/span>explode<\/span>(<\/span>':' <\/span>,
\n<\/span>base64_decode<\/span>(<\/span>substr<\/span>(<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>, <\/span>6<\/span>)));<\/span>} <\/span>
\n<\/span>
\n<\/code><\/div>\n

As an example please see the patch for phpWiki below:<\/p>\n


\n# Author: Stepan A. Baranov (rosmir@gmail.com)
\n# web-site: www.rosmir.org<\/span><\/span><\/code><\/code>diff <\/span>-<\/span>u <\/span>.\/<\/span>admin<\/span>.<\/span>php<\/span>.<\/span>orig <\/span>.\/<\/span>admin<\/span>.<\/span>php<\/span><\/span><\/code><\/code><\/p>\n

--- .\/<\/span>admin<\/span>.<\/span>php<\/span>.<\/span>orig<\/span><\/span><\/code><\/code><\/p>\n

+++ .\/<\/span>admin<\/span>.<\/span>php<\/span><\/span><\/code><\/code><\/p>\n

@@ -<\/span>18<\/span>,<\/span>9 <\/span>+<\/span>18<\/span>,<\/span>16 <\/span>@@<\/span><\/span><\/code><\/code>exit;<\/p>\n

<\/code><\/code><\/p>\n

}<\/span><\/span><\/code><\/code><\/p>\n

\/\/ ADDED by rosmir@gmail.com<\/span><\/span><\/code><\/code><\/p>\n

if(<\/span>preg_match<\/span>(<\/span>'\/Basic+(.*)$\/i'<\/span>, <\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>, <\/span>$matches<\/span>))<\/span><\/span><\/code><\/code><\/p>\n

{<\/span><\/span><\/code><\/code><\/p>\n

list(<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>]<\/span>, <\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>]<\/span>) = <\/span>explode<\/span>(<\/span>':' <\/span>,
\n<\/span>base64_decode<\/span>(<\/span>substr<\/span>(<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_
\nAUTHORIZATION'<\/span>]<\/span>, <\/span>6<\/span>)));<\/span><\/span><\/code><\/code><\/p>\n

}<\/span><\/span><\/code><\/code><\/p>\n

\/\/ END ADDED by rosmir@gmail.com<\/span><\/span><\/code><\/code>\/\/ From the manual, Chapter 16<\/p>\n

<\/code><\/code><\/p>\n

if ((<\/span>$PHP_AUTH_USER <\/span>!= <\/span>$wikiadmin <\/span>) ||<\/span><\/span><\/code><\/code>(<\/p>\n

$PHP_AUTH_PW <\/span>!= <\/span>$adminpasswd<\/span>)) <\/span>{<\/span><\/span><\/code><\/code><\/p>\n

if ((<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>] <\/span>!= <\/span>$wikiadmin <\/span>) ||<\/span><\/span><\/code><\/code>(<\/p>\n

$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>] <\/span>!= <\/span>$adminpasswd<\/span>)) <\/span>{<\/span><\/span><\/code><\/code>Header<\/p>\n

(<\/span>\"WWW-Authenticate: Basic realm=\"<\/span>PhpWiki<\/span>\"\"<\/span>);<\/span><\/span><\/code><\/code><\/p>\n

Header<\/span>(<\/span>\"HTTP\/1.0 401 Unauthorized\"<\/span>);<\/span><\/span><\/code><\/code>echo<\/p>\n

gettext<\/span>(<\/span>\"You entered an invalid login or password.\"<\/span>); <\/span>
\n<\/span>
\n<\/code><\/p>\n<\/div>\n","protected":false,"plain":"When using Fast-CGI<\/b> to pass authentication headers, these headers are passed to the script however they are ignored by PHP. This is because only the \u201cHTTP_AUTHORIZATION\u201d environmental variable gets checked while the \u201cAuthorization\u201d variable is ignored. The following steps can be used to overcome this problem:\r\nCreate a .htaccess file in the root directory of the script\/application you are using:\r\n

\r\nRewriteEngine onRewriteRule <\/span>.* - <\/span>[E<\/span>=<\/span>HTTP_AUTHORIZATION<\/span>:%\r\n<\/span>{HTTP<\/span>:<\/span>Authorization}<\/span>,<\/span>L]<\/span>. <\/span>\r\n<\/span>\r\n<\/code><\/div>\r\nNext you need to change all the PHP_AUTH_USER and PHP_AUTH_PW variables in your web content to\r\n
\r\n$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>] <\/span>and\r\n<\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>] <\/span>\r\n<\/span>\r\n<\/code><\/div>\r\n.\r\n\r\nFinally you will need to add the following lines of code preceding the authentication code used in your application \/ script:\r\n
\r\n:if(<\/span>preg_match<\/span>(<\/span>'\/Basic+(.*)$\/i'<\/span>,&<\/span>nbsp<\/span>;&<\/span>nbsp<\/span>;\r\n<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>,\r\n<\/span>$matches<\/span>))\r\n<\/span>{\r\n<\/span>list(<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>]<\/span>,\r\n<\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>]<\/span>) = <\/span>explode<\/span>(<\/span>':' <\/span>,\r\n<\/span>base64_decode<\/span>(<\/span>substr<\/span>(<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>, <\/span>6<\/span>)));<\/span>} <\/span>\r\n<\/span>\r\n<\/code><\/div>\r\nAs an example please see the patch for phpWiki below:\r\n
\r\n# Author: Stepan A. Baranov (rosmir@gmail.com)\r\n# web-site: www.rosmir.org<\/span><\/span><\/code><\/code>diff <\/span>-<\/span>u <\/span>.\/<\/span>admin<\/span>.<\/span>php<\/span>.<\/span>orig <\/span>.\/<\/span>admin<\/span>.<\/span>php<\/span><\/span><\/code><\/code>\r\n\r\n--- .\/<\/span>admin<\/span>.<\/span>php<\/span>.<\/span>orig<\/span><\/span><\/code><\/code>\r\n\r\n+++ .\/<\/span>admin<\/span>.<\/span>php<\/span><\/span><\/code><\/code>\r\n\r\n@@ -<\/span>18<\/span>,<\/span>9 <\/span>+<\/span>18<\/span>,<\/span>16 <\/span>@@<\/span><\/span><\/code><\/code>exit;\r\n\r\n<\/code><\/code>\r\n\r\n}<\/span><\/span><\/code><\/code>\r\n\r\n\/\/ ADDED by rosmir@gmail.com<\/span><\/span><\/code><\/code>\r\n\r\nif(<\/span>preg_match<\/span>(<\/span>'\/Basic+(.*)$\/i'<\/span>, <\/span>$_SERVER[<\/span>'REDIRECT_HTTP_AUTHORIZATION'<\/span>]<\/span>, <\/span>$matches<\/span>))<\/span><\/span><\/code><\/code>\r\n\r\n{<\/span><\/span><\/code><\/code>\r\n\r\nlist(<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>]<\/span>, <\/span>$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>]<\/span>) = <\/span>explode<\/span>(<\/span>':' <\/span>,\r\n<\/span>base64_decode<\/span>(<\/span>substr<\/span>(<\/span>$_SERVER[<\/span>'REDIRECT_HTTP_\r\nAUTHORIZATION'<\/span>]<\/span>, <\/span>6<\/span>)));<\/span><\/span><\/code><\/code>\r\n\r\n}<\/span><\/span><\/code><\/code>\r\n\r\n\/\/ END ADDED by rosmir@gmail.com<\/span><\/span><\/code><\/code>\/\/ From the manual, Chapter 16\r\n\r\n<\/code><\/code>\r\n\r\nif ((<\/span>$PHP_AUTH_USER <\/span>!= <\/span>$wikiadmin <\/span>) ||<\/span><\/span><\/code><\/code>(\r\n\r\n$PHP_AUTH_PW <\/span>!= <\/span>$adminpasswd<\/span>)) <\/span>{<\/span><\/span><\/code><\/code>\r\n\r\nif ((<\/span>$_SERVER[<\/span>'PHP_AUTH_USER'<\/span>] <\/span>!= <\/span>$wikiadmin <\/span>) ||<\/span><\/span><\/code><\/code>(\r\n\r\n$_SERVER[<\/span>'PHP_AUTH_PW'<\/span>] <\/span>!= <\/span>$adminpasswd<\/span>)) <\/span>{<\/span><\/span><\/code><\/code>Header\r\n\r\n(<\/span>\"WWW-Authenticate: Basic realm=\"<\/span>PhpWiki<\/span>\"\"<\/span>);<\/span><\/span><\/code><\/code>\r\n\r\nHeader<\/span>(<\/span>\"HTTP\/1.0 401 Unauthorized\"<\/span>);<\/span><\/span><\/code><\/code>echo\r\n\r\ngettext<\/span>(<\/span>\"You entered an invalid login or password.\"<\/span>); <\/span>\r\n<\/span>\r\n<\/code>\r\n\r\n<\/div>"},"excerpt":{"rendered":"

When using Fast-CGI to pass authentication headers, these headers are ignored by PHP. The following steps can be used to overcome this problem.<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"lsx_disable_title":"0","_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","footnotes":""},"categories":[179,166],"tags":[],"topics":[],"class_list":["post-2449","post","type-post","status-publish","format-standard","hentry","category-php","category-website"],"acf":[],"additional_meta":{"category_title":[{"term_id":179,"name":"PHP","slug":"php","term_group":0,"term_taxonomy_id":179,"taxonomy":"category","description":"Allowing you to create dynamic content that interacts with databases","parent":168,"count":20,"filter":"raw","term_order":"97","cat_ID":179,"category_count":20,"category_description":"Allowing you to create dynamic content that interacts with databases","cat_name":"PHP","category_nicename":"php","category_parent":168},{"term_id":166,"name":"Website","slug":"website","term_group":0,"term_taxonomy_id":166,"taxonomy":"category","description":"About your Website(s)","parent":0,"count":169,"filter":"raw","term_order":"120","cat_ID":166,"category_count":169,"category_description":"About your Website(s)","cat_name":"Website","category_nicename":"website","category_parent":0}],"tag_title":false},"featured_image_src":null,"author_info":{"display_name":"marketing","author_link":"https:\/\/xneelo.co.za\/help-centre\/author\/marketing\/","author_avatar":"https:\/\/secure.gravatar.com\/avatar\/a6ea315e112423b2b955cb020fbce2b0835956c6ad85ff0f13f1db298977eaaa?s=96&d=mm&r=g"},"_links":{"self":[{"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/posts\/2449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/comments?post=2449"}],"version-history":[{"count":0,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/posts\/2449\/revisions"}],"wp:attachment":[{"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/media?parent=2449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/categories?post=2449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/tags?post=2449"},{"taxonomy":"topics","embeddable":true,"href":"https:\/\/xneelo.co.za\/help-centre\/wp-json\/wp\/v2\/topics?post=2449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}