54

For some reason, none of the code within

if (isset($_SERVER['PHP_AUTH_USER']) &&
    isset($_SERVER['PHP_AUTH_PW']))
{

// When the above is set, the code that is here will execute of course

}

is being executed for me. When I enter the correct username and password, the prompt box for the authorization again pops up. Wouldn't both fields be 'set' if they are correct and I press enter? But for some reason that is not the case. What can I be doing wrong? Thank you.

8 Answers 8

83

There is a 'sensible way' to use HTTP Basic Auth in CGI-mode PHP: in the .htaccess use

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

and in the PHP use

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = 
  explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));
10
  • 12
    For some reason, on my server I had to use $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
    – ChrisV
    Oct 17, 2011 at 11:40
  • 7
    This worked for me with just the RewriteRule line in .htacess. I didn't have to make any changes to the PHP, and $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are now set.
    – tremby
    Sep 10, 2013 at 22:32
  • 3
  • 4
    Can anyone explain the RewriteRule in this reply? It worked for me, but I actually do not understand it. :-)
    – Jan
    Jan 5, 2015 at 14:54
  • 6
    try first to check if the $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] is set and not empty then you can use list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));, because some servers same in my case has REDIRECT_HTTP_AUTHORIZATION index and not HTTP_AUTHORIZATION so better set a full condition for both offsets. Dec 3, 2016 at 17:28
27

try this

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>

on your .htaccess file which you will have to place into the root directory

and then

list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($_SERVER['HTTP_AUTHORIZATION'], 6)));

in the begining of your php scripts

2
  • 1
    @garyJ, It's the length of "basic " Aug 22, 2018 at 1:32
  • can you explain to me why this line is needed in .htaccess? It worked for me Aug 31, 2020 at 17:33
13

I am using Symfony 2.5.7 running on PHP-PFM + Apache 2.4 on Ubuntu 14.04. I have BASIC_AUTH working, it needs to correctly configure the Apache VirtualHost by adding:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

as also mentioned here.

1
  • same here: PHP running in PHP-FPM mode, apache 2.4, centOS. I just had to add that line to my vhost config and it worked perfectly, with no changes on the PHP side Feb 15, 2018 at 23:06
11

Starting from Apache 2.4.13, you simply need to use CGIPassAuth directive in your .htaccess:

CGIPassAuth On
2
  • this is the correct solution in my opinion, the others are workarounds Sep 2, 2021 at 0:01
  • Best new feature, fixed me right up.
    – Billdr
    Nov 7, 2021 at 18:29
3

According to phpinfo(), my server API is CGI/Fast CGI, so I've solved the problem by putting the following in my .htaccess file:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]
2

Try $_SERVER['REMOTE_USER']. This works for me on a PHP 5.3 CGI + Apache installation.

1
  • Seems not to work under a Plesk installation with LAMP (sorry, I have no idea what version of Plesk this particular provider is using; Apache is the old 2.2 and PHP the even older 5.3.3). Dec 11, 2018 at 20:37
2

If user access is granted giving username/password in URL please check if

AuthType Digest

is entitled in your VHost/Directory/.htaccess configuration.

This fixed it for my use case.

-3

On my host's servers, use $_SERVER['REDIRECT_REMOTE_USER'] instead of $_SERVER['PHP_AUTH_USER']

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.