{"id":1235,"date":"2009-04-29T12:01:39","date_gmt":"2009-04-29T10:01:39","guid":{"rendered":"http:\/\/planetozh.com\/blog\/?p=1235"},"modified":"2009-04-29T12:01:39","modified_gmt":"2009-04-29T10:01:39","slug":"http-authentication-on-php-as-cgi-like-dreamhost","status":"publish","type":"post","link":"https:\/\/planetozh.com\/blog\/2009\/04\/http-authentication-on-php-as-cgi-like-dreamhost\/","title":{"rendered":"HTTP Authentication on PHP as CGI (like Dreamhost)"},"content":{"rendered":"

Using PHP's HTTP Authentication<\/a> is a simple way to protect scripts behind a login\/password prompt. There's one little problem: it's supposed to work only on PHP as an Apache module, not the CGI version. It took me a while, hair pulling and some googling to get a basic HTTP Auth system working on Dreamhost's PHP as CGI so for my own future reference, and for anyone that would find it useful, here's the trick.
\n<\/p>\n

First, you need a little .htaccess twist:<\/p>\n

<IfModule mod_rewrite.c>\r\nRewriteEngine on\r\nRewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]\r\n<\/IfModule><\/code><\/pre><\/div>\n
This will pass authorization tokens into an environment variable named REMOTE_USER.<\/p>\n
Then, the PHP script:<\/p>\n
<?php\r\n\/\/ Split the user\/pass variable\r\nlist($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) =\r\n\texplode(':' , base64_decode(substr($_SERVER['REDIRECT_REMOTE_USER'], 6)));\r\n\r\n\r\n\/\/ Open a user\/pass prompt if needed\r\nif (!$_SERVER['PHP_AUTH_USER']) {\r\n\theader('WWW-Authenticate: Basic realm="My Realm"');\r\n\theader('HTTP\/1.0 401 Unauthorized');\r\n\techo 'You cannot see this, sorry.'; \/\/ in case they hit "Cancel"\r\n\texit;\r\n\r\n\/\/ or deal with the login\/password (like, check them, obviously)\r\n} else {\r\n\techo "<p>Hello, <\/p>".$_SERVER['PHP_AUTH_USER'];\r\n\techo "<p>You entered as your password: <\/p>".$_SERVER['PHP_AUTH_PW'];\r\n}\r\n?><\/code><\/pre><\/div>\n
This is labeled as "WORKSFORME" on Dreamhost's PHP as CGI (PHP Version 5.2.6, for the record).<\/p>\n","protected":false},"excerpt":{"rendered":"
Using PHP's HTTP Authentication is a simple way to protect scripts behind a login\/password prompt. There's one little problem: it's supposed to work only on PHP as an Apache module, not the CGI version. It took me a while, hair pulling and some googling to get a basic HTTP Auth system working on Dreamhost's PHP as CGI so for my\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[2,314,10],"class_list":["post-1235","post","type-post","status-publish","format-standard","hentry","category-published","tag-code","tag-dreamhost","tag-php"],"_links":{"self":[{"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/posts\/1235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/comments?post=1235"}],"version-history":[{"count":0,"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/posts\/1235\/revisions"}],"wp:attachment":[{"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/media?parent=1235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/categories?post=1235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/planetozh.com\/blog\/wp-json\/wp\/v2\/tags?post=1235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}