ttavoy our Apache suexec environment scrubs PHP_AUTH_USER and a lot of other environment variables prior to handing the request off to PHP.
To work around it, you'll need .htaccess (sorry!) to rewrite the request like so:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP:Authorization} ^Basic.*
RewriteRule (.*) index.php?Authorization=%{HTTP:Authorization} [QSA,L]
</IfModule>
This appends the auth hash to the request with the parameter Authorization. Then, in index.php, get the authorization info from the Authorization parameter eg:
<?php
$authorized = false;
if (isset($_GET['Authorization'])) {
// Check for the HTTP authentication string in $_GET['Authorization'],
// and put it in the $auth variable
if (preg_match('/Basic\s+(.*)$/i', $_GET['Authorization'], $auth)) {
// Split the string, base64 decode it, and place the values into
// the $authName and $authPassword variables
list($authName, $authPassword) = explode(':', base64_decode($auth[1]));
// Check the values of $authName and $authPass using your login routine
// (in this example, we'll just assume that the login check was successful)
//if (do_some_sort_of_login_check($authName, $authPassword)) {
$authorized = true;
//}
}
}
if ($authorized) {
// Success! Display your content
echo "success! hello, ".$authName;
} else {
// Force the browser to prompt for a username and password
header('WWW-Authenticate: Basic realm="name of your realm"');
header('HTTP/1.0 401 Unauthorized');
echo "authorization failed";
}
?>
Hope this helps 🙂
