5

Is there a way to have PHP redirect to a new page, and pass along HTTP-AUTH?

I have been using cURL, as the second example here: Sending basic authentication information via form

Unfortunately, when I do this, the actual URL (as displayed in the browser URL bar) remains the originating PHP's URL, not the target that I'm browsing.

Here is what I've got so far:

<?php

$user = "xyz";
$pass = "abc";
$userpass = $user . ":" . $pass;

$url = "http://website/directory/";
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_USERPWD, $userpass);
$result = curl_exec($ch);
$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if($httpcode == 200){
    header("Authorization: Basic " . base64_encode($userpass));
    echo $result;
}else{
    header("Location: http://website/login.php");
}

?>

I have also tried replacing the tail end of the above:

if($httpcode == 200){
    header("Authorization: Basic " . base64_encode($userpass));
    header("Location: http://website/directory/");
}else{
    header("Location: http://website/login.php");
}

But that fails; it redirects to http://website.xyz/directory, but it does not pass in the user/pass, and I am presented with a login from the server upon arrival.

Technically, the following works. However, I'd much prefer a more graceful solution than passing user/pass inside the HREF:

header("Location: http://" . $userpass . "website/directory/");
0

2 Answers 2

3

Try to pass the Authentication along with the url. Like this:

header('Location: http://username:password@website/directory/');

As base64 is insecure like plain text, it shouldn't be an additional security risk. Browsers will not display the user:pass related part of the url in address bar. But the browser will display a message box (or something else) to let you confirm that you are about to login to this site using username: yourusername

11
  • I thought of that, too. It does not seem to actually pass the HTTP-AUTH to the new page when it is redirected; I am still prompted by the webserver for user/pass upon arriving at the new location.
    – ltwally
    Apr 4, 2013 at 18:36
  • 1
    Are you sure that the website you are redirecting to is accepting your credentials? I've tested it on localhost with two different folders, and it worked
    – hek2mgl
    Apr 4, 2013 at 18:41
  • 1
    I you look at my code above, and replace "echo $result;" with "header('Location: website/directory');", that is what I have tried. It failed. Upon arriving at website/directory, I was presented with a login prompt.
    – ltwally
    Apr 4, 2013 at 18:59
  • I am new to this site, and finding the comment section's limitations frustrating. The "website/directory" actually has an http in front of it. Apologies if it looks different than I typed it.
    – ltwally
    Apr 4, 2013 at 19:01
  • Use backticks to escape http://server.com/script.php if you want to display them in comments. Also there is a help button ;)
    – hek2mgl
    Apr 4, 2013 at 19:03
1

An explanation of the issue you're having: The Authorization header is only valid in HTTP requests. It has no meaning in a HTTP response, like where you're putting it, and thus browsers are ignoring it.

The solution you've been given (passing the username and password in the URL) is as good as you're going to get. There's no alternative available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.