Download presentation
Presentation is loading. Please wait.
1
PHP-based Authentication
From:
2
Methods to implement Authentication
Basic Authentication Session Based Authentication (see in session) Basic Authentication Session Based Authentication
3
Compare..
4
Basic Authentication When you explicitly send the appropriate HTTP headers from a PHP script to a Web browser an authentication dialog box will be displayed. The dialog box prompts you to enter a username and password. PHP assigns the username and password entered to the global variables $_SERVER[‘PHP_AUTH_USER’] and $_SERVER[‘PHP_AUTH_PW’], respectively.
5
Header() PHP header() function enables you to output a specific HTTP header string, such as a location redirection, or in our case, a "401" response code: "Unauthorized“ This type of header, combined with a "WWW-Authenticate" header, will activate an authentication dialog box.
6
EX1 : <?php header('WWW-Authenticate: Basic realm="Private"'); header('HTTP/1.0 401 Unauthorized'); exit; ?>
7
EX2: <?php if ((!isset( $_SEVER[‘PHP_AUTH_USER’] )) || (!isset($_SERVER[‘PHP_AUTH_PW’]))) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/1.0 401 Unauthorized' ); echo 'Authorization Required.'; exit; } else { echo "You entered {$_SERVER[‘PHP_AUTH_USER’] }for a username.<BR>"; echo "You entered {$_SERVER[‘PHP_AUTH_PW’]} for a password.<BR>"; } ?>
8
Using Hard-Coded Values
<?php if ( ( !isset( $_SERVER['PHP_AUTH_USER'])) || (!isset($_SERVER['PHP_AUTH_PW'])) || ( $_SERVER['PHP_AUTH_USER'] != 'user' ) || ( $_SERVER['PHP_AUTH_PW'] != 'open' ) ) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/ Unauthorized' ); echo 'Authorization Required.'; exit; } else {echo 'Success!';} ?>
9
PHP-based authentication isn't like
PHP-based authentication isn't like .htaccess or server-based authentication A layer of security is not placed over all the contents of an entire directory
10
EX: redirect after success
<?php if ( ( !isset( $_SERVER['PHP_AUTH_USER'] )) || (!isset($_SERVER['PHP_AUTH_PW'])) || ( $_SERVER['PHP_AUTH_USER'] != 'user' ) || ( $_SERVER['PHP_AUTH_PW'] != 'open' ) ) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/ Unauthorized' ); echo 'Authorization Required.'; exit; } else { header( 'Location: ); } ?>
11
EX : print HTML after success
<?php if((!isset($_SERVER['PHP_AUTH_USER']))||(!isset($_SERVER['PHP_AUTH_PW']))||($_SERVER['PHP_AUTH_USER']!= 'user')||($_SERVER['PHP_AUTH_PW']!='open')) { header( 'WWW-Authenticate: Basic realm="Private"' ); header( 'HTTP/ Unauthorized' ); echo 'Authorization Required.'; exit; } else { echo ‘ <HTML><HEAD><TITLE>Secret Stuff</TITLE></HEAD> <BODY> <H1>SECRET!</H1> <P>This is a secret message.</P> </BODY> </HTML>'; }
12
In re-direction and links, can add parameters: header("Location:page2
In re-direction and links, can add parameters: header("Location:page2.php?user=$username"); For encrypt in php: crypt(), md5()
13
See also : Validate Username/Passwords Using a Flat File
Validate Username/Passwords Using a .htpasswd File Validate Username/Passwords Using a Database
Similar presentations
