2

On Mac OS 10.9.1 with PHP 5.4.17 and curl 7.30.0, this curl request runs fine at the command line:

curl -u test:test http://localhost/protected/

But this PHP script using the curl library fails:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://localhost/protected/');
curl_setopt($ch, CURLOPT_HTTPAUTH, 'CURLAUTH_BASIC');
curl_setopt($ch, CURLOPT_USERPWD, 'test:test');
curl_setopt($ch, CURLOPT_VERBOSE, TRUE);
echo curl_exec($ch);
curl_close($ch);

The output is:

$ php -e ./test.php 
* Adding handle: conn: 0x7fe1b303de00
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x7fe1b303de00) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 80 (#0)
*   Trying ::1...
* Connected to localhost (::1) port 80 (#0)
> GET /protected/ HTTP/1.1
Host: localhost
Accept: */*

< HTTP/1.1 401 Authorization Required
< Date: Sat, 25 Jan 2014 03:12:40 GMT
* Server Apache/2.2.24 (Unix) DAV/2 PHP/5.4.17 mod_ssl/2.2.24 OpenSSL/0.9.8y is not blacklisted
< Server: Apache/2.2.24 (Unix) DAV/2 PHP/5.4.17 mod_ssl/2.2.24 OpenSSL/0.9.8y
< WWW-Authenticate: Basic realm="Restricted Files"
< Content-Length: 401
< Content-Type: text/html; charset=iso-8859-1
<
[...]

Note that the "Authorization: Basic ..." line is missing from the request header. It works fine if I manually set a request header like this:

curl_setopt($ch, CURLOPT_HTTPHEADER, array(base64_encode('test:test')));

An older system running Mac OS 10.7.5 with PHP 5.4.11 and curl 7.21.4 correctly sends the Authorization header. I tried many different combinations of PHP (5.4.11, 5.4.17, 5.4.24, 5.5.8) and curl (7.30.0, 7.30.4), but on Mac OS 10.9.1, they all failed to send the Authorization header unless I set it manually. Why?

1 Answer 1

0

This is wrong:

curl_setopt($ch, CURLOPT_HTTPAUTH, 'CURLAUTH_BASIC');
                                   ^--            ^--

with the quotes, you're trying to set a string as the option. But CURL uses define()'d constants, which are NOT quoted.

Try

curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);

so you're using the actual CURL constant, not some random string that happens to LOOK like a constant.

1
  • You're absolutely right; CURLAUTH_BASIC should be a constant, not a string. But now I want to know how the quoted version ever worked. It's in a library I've been using daily for 5 years.
    – user3232706
    Jan 25, 2014 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.