features.http-auth.html
来自「php的帮助文档,涉及到PHP的案例和基本语法,以及实际应用内容」· HTML 代码 · 共 195 行 · 第 1/2 页
HTML
195 行
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <title>HTTP authentication with PHP</title> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body><div style="text-align: center;"> <div class="prev" style="text-align: left; float: left;"><a href="features.html">Features</a></div> <div class="next" style="text-align: right; float: right;"><a href="features.cookies.html">Cookies</a></div> <div class="up"><a href="features.html">Features</a></div> <div class="home"><a href="index.html">PHP Manual</a></div></div><hr /><div> <h1>HTTP authentication with PHP</h1> <p class="simpara"> The <acronym title="Hypertext Transfer Protocol">HTTP</acronym> Authentication hooks in PHP are only available when it is running as an Apache module and is hence not available in the CGI version. In an Apache module PHP script, it is possible to use the <a href="function.header.html" class="function">header()</a> function to send an "Authentication Required" message to the client browser causing it to pop up a Username/Password input window. Once the user has filled in a username and a password, the URL containing the PHP script will be called again with the <a href="reserved.variables.html" class="link">predefined variables</a> <var class="varname">PHP_AUTH_USER</var>, <var class="varname">PHP_AUTH_PW</var>, and <var class="varname">AUTH_TYPE</var> set to the user name, password and authentication type respectively. These predefined variables are found in the <var class="varname"><a href="reserved.variables.server.html" class="classname">$_SERVER</a></var> and <var class="varname">$HTTP_SERVER_VARS</var> arrays. Both "Basic" and "Digest" (since PHP 5.1.0) authentication methods are supported. See the <a href="function.header.html" class="function">header()</a> function for more information. </p> <blockquote><p><b class="note">Note</b>: <b>PHP Version Note</b><br /> <a href="language.variables.superglobals.html" class="link">Superglobals</a>, such as <var class="varname"><a href="reserved.variables.server.html" class="classname">$_SERVER</a></var>, became available in PHP <a href="http://www.php.net/releases/4_1_0.php" class="link external">» 4.1.0</a>. <br /> </p></blockquote> <p class="para"> An example script fragment which would force client authentication on a page is as follows: </p> <p class="para"> <div class="example"> <p><b>Example #1 Basic HTTP Authentication example</b></p> <div class="example-contents"><div class="phpcode"><code><span style="color: #000000"><span style="color: #0000BB"><?php<br /></span><span style="color: #007700">if (!isset(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'PHP_AUTH_USER'</span><span style="color: #007700">])) {<br /> </span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'WWW-Authenticate: Basic realm="My Realm"'</span><span style="color: #007700">);<br /> </span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'HTTP/1.0 401 Unauthorized'</span><span style="color: #007700">);<br /> echo </span><span style="color: #DD0000">'Text to send if user hits Cancel button'</span><span style="color: #007700">;<br /> exit;<br />} else {<br /> echo </span><span style="color: #DD0000">"<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>"</span><span style="color: #007700">;<br /> echo </span><span style="color: #DD0000">"<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>"</span><span style="color: #007700">;<br />}<br /></span><span style="color: #0000BB">?></span></span></code></div> </div> </div> </p> <p class="para"> <div class="example"> <p><b>Example #2 Digest HTTP Authentication example</b></p> <div class="example-contents"><p> This example shows you how to implement a simple Digest HTTP authentication script. For more information read the <a href="http://www.faqs.org/rfcs/rfc2617" class="link external">» RFC 2617</a>. </p></div> <div class="example-contents"><div class="phpcode"><code><span style="color: #000000"><span style="color: #0000BB"><?php<br />$realm </span><span style="color: #007700">= </span><span style="color: #DD0000">'Restricted area'</span><span style="color: #007700">;<br /><br /></span><span style="color: #FF8000">//user => password<br /></span><span style="color: #0000BB">$users </span><span style="color: #007700">= array(</span><span style="color: #DD0000">'admin' </span><span style="color: #007700">=> </span><span style="color: #DD0000">'mypass'</span><span style="color: #007700">, </span><span style="color: #DD0000">'guest' </span><span style="color: #007700">=> </span><span style="color: #DD0000">'guest'</span><span style="color: #007700">);<br /><br /><br />if (empty(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'PHP_AUTH_DIGEST'</span><span style="color: #007700">])) {<br /> </span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'HTTP/1.1 401 Unauthorized'</span><span style="color: #007700">);<br /> </span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'WWW-Authenticate: Digest realm="'</span><span style="color: #007700">.</span><span style="color: #0000BB">$realm</span><span style="color: #007700">.<br /> </span><span style="color: #DD0000">'",qop="auth",nonce="'</span><span style="color: #007700">.</span><span style="color: #0000BB">uniqid</span><span style="color: #007700">().</span><span style="color: #DD0000">'",opaque="'</span><span style="color: #007700">.</span><span style="color: #0000BB">md5</span><span style="color: #007700">(</span><span style="color: #0000BB">$realm</span><span style="color: #007700">).</span><span style="color: #DD0000">'"'</span><span style="color: #007700">);<br /><br /> die(</span><span style="color: #DD0000">'Text to send if user hits Cancel button'</span><span style="color: #007700">);<br />}<br /><br /><br /></span><span style="color: #FF8000">// analyze the PHP_AUTH_DIGEST variable<br /></span><span style="color: #007700">if (!(</span><span style="color: #0000BB">$data </span><span style="color: #007700">= </span><span style="color: #0000BB">http_digest_parse</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'PHP_AUTH_DIGEST'</span><span style="color: #007700">])) ||<br /> !isset(</span><span style="color: #0000BB">$users</span><span style="color: #007700">[</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'username'</span><span style="color: #007700">]]))<br /> die(</span><span style="color: #DD0000">'Wrong Credentials!'</span><span style="color: #007700">);<br /><br /><br /></span><span style="color: #FF8000">// generate the valid response<br /></span><span style="color: #0000BB">$A1 </span><span style="color: #007700">= </span><span style="color: #0000BB">md5</span><span style="color: #007700">(</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'username'</span><span style="color: #007700">] . </span><span style="color: #DD0000">':' </span><span style="color: #007700">. </span><span style="color: #0000BB">$realm </span><span style="color: #007700">. </span><span style="color: #DD0000">':' </span><span style="color: #007700">. </span><span style="color: #0000BB">$users</span><span style="color: #007700">[</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'username'</span><span style="color: #007700">]]);<br /></span><span style="color: #0000BB">$A2 </span><span style="color: #007700">= </span><span style="color: #0000BB">md5</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'REQUEST_METHOD'</span><span style="color: #007700">].</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'uri'</span><span style="color: #007700">]);<br /></span><span style="color: #0000BB">$valid_response </span><span style="color: #007700">= </span><span style="color: #0000BB">md5</span><span style="color: #007700">(</span><span style="color: #0000BB">$A1</span><span style="color: #007700">.</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'nonce'</span><span style="color: #007700">].</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'nc'</span><span style="color: #007700">].</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'cnonce'</span><span style="color: #007700">].</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'qop'</span><span style="color: #007700">].</span><span style="color: #DD0000">':'</span><span style="color: #007700">.</span><span style="color: #0000BB">$A2</span><span style="color: #007700">);<br /><br />if (</span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'response'</span><span style="color: #007700">] != </span><span style="color: #0000BB">$valid_response</span><span style="color: #007700">)<br /> die(</span><span style="color: #DD0000">'Wrong Credentials!'</span><span style="color: #007700">);<br /><br /></span><span style="color: #FF8000">// ok, valid username & password<br /></span><span style="color: #007700">echo </span><span style="color: #DD0000">'Your are logged in as: ' </span><span style="color: #007700">. </span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #DD0000">'username'</span><span style="color: #007700">];<br /><br /><br /></span><span style="color: #FF8000">// function to parse the http auth header<br /></span><span style="color: #007700">function </span><span style="color: #0000BB">http_digest_parse</span><span style="color: #007700">(</span><span style="color: #0000BB">$txt</span><span style="color: #007700">)<br />{<br /> </span><span style="color: #FF8000">// protect against missing data<br /> </span><span style="color: #0000BB">$needed_parts </span><span style="color: #007700">= array(</span><span style="color: #DD0000">'nonce'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'nc'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'cnonce'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'qop'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'username'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'uri'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">, </span><span style="color: #DD0000">'response'</span><span style="color: #007700">=></span><span style="color: #0000BB">1</span><span style="color: #007700">);<br /> </span><span style="color: #0000BB">$data </span><span style="color: #007700">= array();<br /><br /> </span><span style="color: #0000BB">preg_match_all</span><span style="color: #007700">(</span><span style="color: #DD0000">'@(\w+)=(?:([\'"])([^\2]+)\2|([^\s,]+))@'</span><span style="color: #007700">, </span><span style="color: #0000BB">$txt</span><span style="color: #007700">, </span><span style="color: #0000BB">$matches</span><span style="color: #007700">, </span><span style="color: #0000BB">PREG_SET_ORDER</span><span style="color: #007700">);<br /><br /> foreach (</span><span style="color: #0000BB">$matches </span><span style="color: #007700">as </span><span style="color: #0000BB">$m</span><span style="color: #007700">) {<br /> </span><span style="color: #0000BB">$data</span><span style="color: #007700">[</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">]] = </span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">] ? </span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">] : </span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">4</span><span style="color: #007700">];<br /> unset(</span><span style="color: #0000BB">$needed_parts</span><span style="color: #007700">[</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">]]);<br /> }<br /><br /> return </span><span style="color: #0000BB">$needed_parts </span><span style="color: #007700">? </span><span style="color: #0000BB">false </span><span style="color: #007700">: </span><span style="color: #0000BB">$data</span><span style="color: #007700">;<br />}<br /></span><span style="color: #0000BB">?></span></span></code></div> </div> </div> </p> <blockquote><p><b class="note">Note</b>: <b>Compatibility Note</b><br /> Please be careful when coding the HTTP header lines. In order to guarantee maximum compatibility with all clients, the keyword "Basic" should be written with an uppercase "B", the realm string must be enclosed in double (not single) quotes, and exactly one space should precede the <em class="emphasis">401</em> code in the <em class="emphasis">HTTP/1.0 401</em> header line. Authentication parameters have to be comma-separated as seen in the digest example above. <br /> </p></blockquote> <p class="para"> Instead of simply printing out <var class="varname">PHP_AUTH_USER</var> and <var class="varname">PHP_AUTH_PW</var>, as done in the above example, you may want to check the username and password for validity. Perhaps by sending a query to a database, or by looking up the user in a dbm file. </p> <p class="para"> Watch out for buggy Internet Explorer browsers out there. They⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?