http basic authentication broken with PHP as cgi/fastCGI under Apache

[keymaster]

The keys PHP_AUTH_USER and PHP_AUTH_PW are not present in the superglobal $_SERVER, so http basic authentication needs to be handled a little differently.

This also affects functional tests which require http basic auth to authenticate.

Basically the workaround is two parts:

1. A rewrite rule to pack the username and password into an environment variable:

   RewriteEngine on RewriteRule .\* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

2. Extract the info from the environment variable:

   list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

See below for more details.

http://orangejuiceliberationfront.com/http-auth-with-php-in-cgi-mode-e-g-on-dreamhost/
http://www.besthostratings.com/articles/http-auth-php-cgi.html

[willdurand]

What about using the apache_request_headers() function ?

See: #1510

[schmittjoh]

@fabpot, should we maybe add some extra abstraction for this to the Request class?

[benjamindulau]

+1, the request should definitly abstract this.

[keymaster]

The following works as a temporary workaround:

app_dev.php:

if( !isset($_SERVER['PHP_AUTH_USER']) )
{
    if (isset($_SERVER['HTTP_AUTHORIZATION']) && (strlen($_SERVER['HTTP_AUTHORIZATION']) > 0)){
        list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
        if( strlen($_SERVER['PHP_AUTH_USER']) == 0 || strlen($_SERVER['PHP_AUTH_PW']) == 0 )
        {
            unset($_SERVER['PHP_AUTH_USER']);
            unset($_SERVER['PHP_AUTH_PW']);
        }
    }
}

web/.htaccess

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L] RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]
</IfModule>

[fabpot]

It works fine for me with FastCGI and Nginx.

Can you paste the whole output of $_SERVER when not using the workaround?

[keymaster]

Here is the output of $_SERVER without the workaround:

    Array
    (
        [ALLUSERSPROFILE] => C:\ProgramData
        [APPDATA] => C:\windows\system32\config\systemprofile\AppData\Roaming
        [asl_log] => Destination=file
        [CLASSPATH] => .;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
        [CommonProgramFiles] => C:\Program Files\Common Files
        [COMPUTERNAME] => HP
        [ComSpec] => C:\windows\system32\cmd.exe
        [DB2INSTANCE] => DB2
        [FP_NO_HOST_CHECK] => NO
        [LOCALAPPDATA] => C:\windows\system32\config\systemprofile\AppData\Local
        [NUMBER_OF_PROCESSORS] => 4
        [OnlineServices] => Online Services
        [OS] => Windows_NT
        [Path] => C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;c:\Program Files\Hewlett-Packard\Drive Encryption\;C:\Program Files\WIDCOMM\Bluetooth Software\;C:\Program Files\Broadcom\Broadcom 802.11\Driver;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Zend\ZendServer\bin
        [PATHEXT] => .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
        [PCBRAND] => s
        [PHPRC] => C:\Program Files\Zend\ZendServer\etc
        [PHP_FCGI_MAX_REQUESTS] => 10000
        [Platform] => BNB
        [PROCESSOR_ARCHITECTURE] => x86
        [PROCESSOR_IDENTIFIER] => x86 Family 6 Model 37 Stepping 5, GenuineIntel
        [PROCESSOR_LEVEL] => 6
        [PROCESSOR_REVISION] => 2505
        [ProgramData] => C:\ProgramData
        [ProgramFiles] => C:\Program Files
        [PSModulePath] => C:\windows\system32\WindowsPowerShell\v1.0\Modules\
        [PTSM_install_path] => c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin
        [PUBLIC] => C:\Users\Public
        [QTJAVA] => C:\Program Files\Java\jre6\lib\ext\QTJava.zip
        [SystemDrive] => C:
        [SystemRoot] => C:\windows
        [TEMP] => C:\Users\User\AppData\Local\Temp
        [TMP] => C:\windows\TEMP
        [USERDOMAIN] => WORKGROUP
        [USERNAME] => HP$
        [USERPROFILE] => C:\windows\system32\config\systemprofile
        [windir] => C:\windows
        [AP_PARENT_PID] => 688
        [_FCGI_CLIENT_PID_] => 2244
        [_FCGI_MUTEX_] => 776
        [_FCGI_NTAUTH_IMPERSONATE_] => 1
        [_FCGI_SHUTDOWN_EVENT_] => 772
        [FCGI_ROLE] => RESPONDER
        [HTTP_HOST] => localhost
        [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
        [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
        [HTTP_ACCEPT_ENCODING] => gzip, deflate
        [HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
        [HTTP_CONNECTION] => keep-alive
        [HTTP_COOKIE] => __utma=1.441182227.1321189418.1322498628.1323267653.4; __utmz=1.1321189418.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ZDEDebuggerPresent=php,phtml,php3; PHPSESSID=nqtap9dur6uja1rjjumcttmc25
        [HTTP_CACHE_CONTROL] => max-age=0
        [PATH] => C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;c:\Program Files\Hewlett-Packard\Drive Encryption\;C:\Program Files\WIDCOMM\Bluetooth Software\;C:\Program Files\Broadcom\Broadcom 802.11\Driver;"C:\Program Files\Zend\ZendServer\bin";"C:\Program Files\Zend\ZendServer\share\ZendFramework\bin";C:\Program Files\Zend\MySQL51\bin;C:\Program Files\Git\cmd;C:\Program Files\Git\bin;C:\Program Files\TortoiseSVN\bin;C:\Program Files\Common Files\HP\Digital Imaging\bin;C:\Program Files\HP\Digital Imaging\bin\;C:\Program Files\HP\Digital Imaging\bin\Qt\Qt 4.3.3;C:\Program Files\QuickTime\QTSystem\;
        [COMSPEC] => C:\windows\system32\cmd.exe
        [WINDIR] => C:\windows
        [SERVER_SIGNATURE] => 
        [SERVER_SOFTWARE] => Apache/2.2.16 (Win32) mod_ssl/2.2.16 OpenSSL/0.9.8o
        [SERVER_NAME] => localhost
        [SERVER_ADDR] => 127.0.0.1
        [SERVER_PORT] => 80
        [REMOTE_ADDR] => 127.0.0.1
        [DOCUMENT_ROOT] => C:/Program Files/Zend/Apache2/htdocs
        [SERVER_ADMIN] => admin@example.com
        [SCRIPT_FILENAME] => C:/Program Files/Zend/Apache2/htdocs/MySite/web/app_dev.php
        [REMOTE_PORT] => 1740
        [GATEWAY_INTERFACE] => CGI/1.1
        [SERVER_PROTOCOL] => HTTP/1.1
        [REQUEST_METHOD] => GET
        [QUERY_STRING] => 
        [REQUEST_URI] => /MySite/web/app_dev.php/
        [SCRIPT_NAME] => /MySite/web/app_dev.php
        [PATH_INFO] => /
        [PATH_TRANSLATED] => C:\Program Files\Zend\Apache2\htdocs\index.html
        [PHP_SELF] => /MySite/web/app_dev.php/
        [REQUEST_TIME] => 1324019271
        [argv] => Array
            (
            )

        [argc] => 0
    )

[kepten]

Finally I've made a working patch for that, I'll submit it as soon as I figure out how to submit a patch... ;)

[stof]

http://help.github.com/send-pull-requests/

[vicb]

Task for the BHD: update the associated PR #3551 (there are some comments there)

[towards]

working on this issue today...

[kepten]

has a working PR, just needs review: #3551

[iftikhardirv]

private $username = 'test';
private $password = 'test';
public function test_auth() {
if($this->authenticate_user()){
echo 'login';exit;
}else{
echo 'failed';exit;
}
}

public function authenticate_user(){
    if( !isset($_SERVER['PHP_AUTH_USER']) )
    {
        header('HTTP/1.0 401 Unauthorized');
        header('HTTP/1.1 401 Unauthorized');
        header('WWW-Authenticate: Basic realm="Realm"');
        echo "You must login to use this service"; // User sees this if hit cancel
        die();            
    }else{
        if($this->username != $_SERVER['PHP_AUTH_USER'] || $this->password != $_SERVER['PHP_AUTH_PW']){
            header('HTTP/1.0 401 Unauthorized');
            header('HTTP/1.1 401 Unauthorized');
            header('WWW-Authenticate: Basic realm="Realm"');
            echo "You must login to use this service"; // User sees this if hit cancel
            die();
        }else{
            return true;
        }
    }
}

[JefferyHus]

# make HTTP Basic Authentication work on php5-fcgi installs
<IfModule mod_fcgid.c>
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

[paulwratt]

thanks for this post, bug fixes and comments - I got this workaround to work on non "symfony", managed to patched "thttpd" web server and "PHP Navigator" file manager with your workarounds.