DooDigestAuth php (backend) authorization management class web browser authorization-PHP Tutorial-php.cn

Home

Backend Development

PHP Tutorial

DooDigestAuth php (backend) authorization management class web browser authorization

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Jul 29, 2016 am 09:15 AM

datahttpmatchrealm

<span>  1</span> <span>php
</span><span>  2</span><span>/*</span><span>*
</span><span>  3</span><span> * DooDigestAuth class file.
</span><span>  4</span><span> *
</span><span>  5</span><span> * @author Leng Sheng Hong <darkredz>
</darkredz></span><span>  6</span><span> * @link http://www.doophp.com/
</span><span>  7</span><span> * @copyright Copyright © 2009 Leng Sheng Hong
</span><span>  8</span><span> * @license http://www.doophp.com/license
</span><span>  9</span><span>*/</span><span> 10</span><span> 11</span><span>/*</span><span>*
</span><span> 12</span><span> * Handles HTTP digest authentication
</span><span> 13</span><span> *
</span><span> 14</span><span> * <p>HTTP digest authentication can be used with the URI router.
</p></span><span> 15</span><span> * HTTP digest is much more recommended over the use of HTTP Basic auth which doesn't provide any encryption.
</span><span> 16</span><span> * If you are running PHP on Apache in CGI/FastCGI mode, you would need to
</span><span> 17</span><span> * add the following line to your .htaccess for digest auth to work correctly.
</span><span> 18</span><span> * <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code>
</span><span> 19</span><span> *
</span><span> 20</span><span> * <p>This class is tested under Apache 2.2 and Cherokee web server. It should work in both mod_php and cgi mode.</p>
</span><span> 21</span><span> *
</span><span> 22</span><span> * @author Leng Sheng Hong <darkredz>
</darkredz></span><span> 23</span><span> * @version $Id: DooDigestAuth.php 1000 2009-07-7 18:27:22
</span><span> 24</span><span> * @package doo.auth
</span><span> 25</span><span> * @since 1.0
</span><span> 26</span><span>*/</span><span> 27</span><span>class</span><span> DooDigestAuth{
</span><span> 28</span><span> 29</span><span>/*</span><span>*
</span><span> 30</span><span>     * Authenticate against a list of username and passwords.
</span><span> 31</span><span>     *
</span><span> 32</span><span>     * <p>HTTP Digest Authentication doesn't work with PHP in CGI mode,
</p></span><span> 33</span><span>     * you have to add this into your .htaccess <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code>
</span><span> 34</span><span>     *
</span><span> 35</span><span>     * @param string $realm Name of the authentication session
</span><span> 36</span><span>     * @param array $users An assoc array of username and password: array('uname1'=>'pwd1', 'uname2'=>'pwd2')
</span><span> 37</span><span>     * @param string $fail_msg Message to be displayed if the User cancel the login
</span><span> 38</span><span>     * @param string $fail_url URL to be redirect if the User cancel the login
</span><span> 39</span><span>     * @return string The username if login success.
</span><span> 40</span><span>*/</span><span> 41</span><span>public</span><span>static</span><span>function</span> http_auth(<span>$realm</span>, <span>$users</span>, <span>$fail_msg</span>=<span>NULL</span>, <span>$fail_url</span>=<span>NULL</span><span>){
</span><span> 42</span><span>$realm</span> = "Restricted area - <span>$realm</span>"<span>;
</span><span> 43</span><span> 44</span><span>//</span><span>user => password
</span><span> 45</span><span>        //$users = array('admin' => '1234', 'guest' => 'guest');</span><span> 46</span><span>if</span>(!<span>empty</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION']) && <span>strpos</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'], 'Digest')===0<span>){
</span><span> 47</span><span>$_SERVER</span>['PHP_AUTH_DIGEST'] = <span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'<span>];
</span><span> 48</span><span>        }
</span><span> 49</span><span> 50</span><span>if</span> (<span>empty</span>(<span>$_SERVER</span>['PHP_AUTH_DIGEST'<span>])) {
</span><span> 51</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 52</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 53</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 54</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 55</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 56</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 57</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 58</span><span>exit</span><span>;
</span><span> 59</span><span>        }
</span><span> 60</span><span> 61</span><span>//</span><span> analyze the PHP_AUTH_DIGEST variable</span><span> 62</span><span>if</span> (!(<span>$data</span> = self::http_digest_parse(<span>$_SERVER</span>['PHP_AUTH_DIGEST'])) || !<span>isset</span>(<span>$users</span>[<span>$data</span>['username'<span>]])){
</span><span> 63</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 64</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 65</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 66</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 67</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 68</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 69</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 70</span><span>exit</span><span>;
</span><span> 71</span><span>        }
</span><span> 72</span><span> 73</span><span>//</span><span> generate the valid response</span><span> 74</span><span>$A1</span> = <span>md5</span>(<span>$data</span>['username'] . ':' . <span>$realm</span> . ':' . <span>$users</span>[<span>$data</span>['username'<span>]]);
</span><span> 75</span><span>$A2</span> = <span>md5</span>(<span>$_SERVER</span>['REQUEST_METHOD'].':'.<span>$data</span>['uri'<span>]);
</span><span> 76</span><span>$valid_response</span> = <span>md5</span>(<span>$A1</span>.':'.<span>$data</span>['nonce'].':'.<span>$data</span>['nc'].':'.<span>$data</span>['cnonce'].':'.<span>$data</span>['qop'].':'.<span>$A2</span><span>);
</span><span> 77</span><span> 78</span><span>if</span> (<span>$data</span>['response'] != <span>$valid_response</span><span>){
</span><span> 79</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 80</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 81</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 82</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 83</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 84</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 85</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 86</span><span>exit</span><span>;
</span><span> 87</span><span>        }
</span><span> 88</span><span> 89</span><span>//</span><span> ok, valid username & password</span><span> 90</span><span>return</span><span>$data</span>['username'<span>];
</span><span> 91</span><span>    }
</span><span> 92</span><span> 93</span><span>/*</span><span>*
</span><span> 94</span><span>     * Method to parse the http auth header, works with IE.
</span><span> 95</span><span>     *
</span><span> 96</span><span>     * Internet Explorer returns a qop="xxxxxxxxxxx" in the header instead of qop=xxxxxxxxxxx as most browsers do.
</span><span> 97</span><span>     *
</span><span> 98</span><span>     * @param string $txt header string to parse
</span><span> 99</span><span>     * @return array An assoc array of the digest auth session
</span><span>100</span><span>*/</span><span>101</span><span>private</span><span>static</span><span>function</span> http_digest_parse(<span>$txt</span><span>)
</span><span>102</span><span>    {
</span><span>103</span><span>$res</span> = <span>preg_match</span>("/username=\"([^\"]+)\"/i", <span>$txt</span>, <span>$match</span><span>);
</span><span>104</span><span>$data</span>['username'] = (<span>isset</span>(<span>$match</span>[1]))?<span>$match</span>[1]:<span>null</span><span>;
</span><span>105</span><span>$res</span> = <span>preg_match</span>('/n/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>106</span><span>$data</span>['nonce'] = <span>$match</span>[1<span>];
</span><span>107</span><span>$res</span> = <span>preg_match</span>('/nc=([0-9]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>108</span><span>$data</span>['nc'] = <span>$match</span>[1<span>];
</span><span>109</span><span>$res</span> = <span>preg_match</span>('/cn/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>110</span><span>$data</span>['cnonce'] = <span>$match</span>[1<span>];
</span><span>111</span><span>$res</span> = <span>preg_match</span>('/qop=([^,]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>112</span><span>$data</span>['qop'] = <span>str_replace</span>('"','',<span>$match</span>[1<span>]);
</span><span>113</span><span>$res</span> = <span>preg_match</span>('/uri=\"([^\"]+)\"/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>114</span><span>$data</span>['uri'] = <span>$match</span>[1<span>];
</span><span>115</span><span>$res</span> = <span>preg_match</span>('/resp/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>116</span><span>$data</span>['response'] = <span>$match</span>[1<span>];
</span><span>117</span><span>return</span><span>$data</span><span>;
</span><span>118</span><span>    }
</span><span>119</span><span>120</span><span>121</span> }

Calling method:

<span>1</span><span>require_once</span>(<span>dirname</span>(<span>__FILE__</span>)."/DooDigestAuth.php"<span>);
</span><span>2</span> DooDigestAuth::http_auth('example.com', <span>array</span>('admin'=>"123456789"));

phpweb authorization login can effectively prevent background brute force cracking

Download address: http://files.cnblogs.com/files/func/DooDigestAuth.zip

The above introduces the DooDigestAuth php (backend) authorization management class web browser authorization, including the content. I hope it will be helpful to friends who are interested in PHP tutorials.

Statement

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Springboot怎么使用内置tomcat禁止不安全HTTPMay 12, 2023 am 11:49 AM

Springboot内置tomcat禁止不安全HTTP方法1、在tomcat的web.xml中可以配置如下内容让tomcat禁止不安全的HTTP方法/*PUTDELETEHEADOPTIONSTRACEBASIC2、Springboot使用内置tomcat没有web.xml配置文件，可以通过以下配置进行，简单来说就是要注入到Spring容器中@ConfigurationpublicclassTomcatConfig{@BeanpublicEmbeddedServletContainerFacto

JAVA发送HTTP请求的方式有哪些Apr 15, 2023 am 09:04 AM

1.HttpURLConnection使用JDK原生提供的net，无需其他jar包，代码如下：importcom.alibaba.fastjson.JSON;importjava.io.BufferedReader;importjava.io.InputStream;importjava.io.InputStreamReader;importjava.io.OutputStream;importjava.net.HttpURLConnection;

Nginx的HTTP2协议优化与安全设置Jun 10, 2023 am 10:24 AM

随着互联网的不断发展和改善，Web服务器在速度和性能上的需求也越来越高。为了满足这样的需求，Nginx已经成功地掌握了HTTP2协议并将其融入其服务器的性能中。HTTP2协议要比早期的HTTP协议更加高效，但同时也存在着特定的安全问题。本文将为您详细介绍如何进行Nginx的HTTP2协议优化和安全设置。一、Nginx的HTTP2协议优化1.启用HTTP2在N

nginx中如何升级到支持HTTP2.0May 24, 2023 pm 10:58 PM

一、前言#ssl写在443端口后面。这样http和https的链接都可以用listen443sslhttp2default_server;server_namechat.chengxinsong.cn;#hsts的合理使用，max-age表明hsts在浏览器中的缓存时间，includesubdomainscam参数指定应该在所有子域上启用hsts，preload参数表示预加载，通过strict-transport-security:max-age=0将缓存设置为0可以撤销hstsadd_head

Nginx中HTTP的keepalive怎么配置May 12, 2023 am 11:28 AM

httpkeepalive在http早期，每个http请求都要求打开一个tpcsocket连接，并且使用一次之后就断开这个tcp连接。使用keep-alive可以改善这种状态，即在一次tcp连接中可以持续发送多份数据而不会断开连接。通过使用keep-alive机制，可以减少tcp连接建立次数，也意味着可以减少time_wait状态连接，以此提高性能和提高httpd服务器的吞吐率(更少的tcp连接意味着更少的系统内核调用,socket的accept()和close()调用)。但是，keep-ali

Python的HTTP客户端模块urllib与urllib3怎么使用May 20, 2023 pm 07:58 PM

一、urllib概述：urllib是Python中请求url连接的官方标准库，就是你安装了python，这个库就已经可以直接使用了，基本上涵盖了基础的网络请求功能。在Python2中主要为urllib和urllib2，在Python3中整合成了urllib。Python3.x中将urllib2合并到了urllib，之后此包分成了以下四个模块：urllib.request：它是最基本的http请求模块，用来模拟发送请求urllib.error：异常处理模块，如果出现错误可以捕获这些异常urllib

Nginx http运行状况健康检查如何配置May 14, 2023 pm 06:10 PM

被动检查对于被动健康检查，nginx和nginxplus会在事件发生时对其进行监控，并尝试恢复失败的连接。如果仍然无法恢复正常，nginx开源版和nginxplus会将服务器标记为不可用，并暂时停止向其发送请求，直到它再次标记为活动状态。上游服务器标记为不可用的条件是为每个上游服务器定义的，其中包含块中server指令的参数upstream：fail_timeout-设置服务器标记为不可用时必须进行多次失败尝试的时间，以及服务器标记为不可用的时间（默认为10秒）。max_fails-设置在fai

怎么利用Java实现调用http请求Jun 02, 2023 pm 04:57 PM

一、概述在实际开发过程中，我们经常需要调用对方提供的接口或测试自己写的接口是否合适。很多项目都会封装规定好本身项目的接口规范，所以大多数需要去调用对方提供的接口或第三方接口（短信、天气等）。在Java项目中调用第三方接口的方式有：1、通过JDK网络类Java.net.HttpURLConnection；2、通过common封装好的HttpClient；3、通过Apache封装好的CloseableHttpClient；4、通过SpringBoot-RestTemplate；二、Java调用第三方

See all articles