HTTP Digest Authorization is supported by PEAR::Auth_HTTP.
But, as you said, it cannot be used when safe_mode = On.
To solve this problem,
I made a simple patch based on your suggestion based on php5 CVS HEAD.
Applying this patch, we can access $_SERVER['PHP_AUTH_DIGEST'] ,
which will be like,
'Digest username="taro", realm="php-users-digest",
nonce="MTExMTkwNjQ2OA==399347e5e0e2688ede69bfe5e707e3a3",
uri="/php/auth/test_digest_simple.php", algorithm=MD5,
response="6ba162b80d63f8960c73405519cea861",
opaque="b7d192a44e0da16cd180ebe85efb7c8f", qop=auth, nc=00000001,
cnonce="082c875dcb2ca740"'.
The Digest Authentication can be performed in Auth_HTTP using this
server variable.
Some utility function such as http_digest_params() to decode
parameters from $_SERVER['PHP_AUTH_DIGEST'] will be also useful
to make the authentication code.
I hope apply this patch into CVS HEAD if there is no objection.
Rui
On Wed, 23 Mar 2005 08:44:14 +0100
LacaK <lacak@users.sourceforge.net> wrote:
> Hi everybody,
> I am looking for somebody, who can implement HTTP Digest Authorization
> in PHP.
> A solution, that could be useful also for many PHP users. (is more
> secure and so more usable than Basic authorization)
>
> "HTTP Basic Authorization" sends password only base64 encoded, and may
> be easily stolen.
> but
> "HTTP Digest Authorization" sends password 'md5 hashed', so for other
> script it is much more harder to steal or gain it.
>
> Wouldnエt it be possible to add in PHP support the Digest Authorization
> for example in a form $_SERVER["PHP_AUTH_DIGEST"], where the header from
> HTTP
> Response would be added if 'Authorization: Digest ...' is used (similar
> as the 'Authorization:
> Basic ...' in $_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"] even
> when safe_mode=On)
>
> 1.PHP must parse HTTP header.
> 2. When it finds Authorization: Basic then fill up
> $_SERVER["PHP_AUTH_USER"] and $_SERVER["PHP_AUTH_PW"]
> 3. add next condition When it finds Authorization: Digest then fill
> $_SERVER["PHP_AUTH_DIGEST"]
> (I think, that it takes only few lines of source code . Modification in
> init_request_info() function in mod_php4.c + ?)
>
> I appended short file, where this modification is marked.
>
> Thank you very much for your time and effort.
> Please reply. Or advice me who I should contact.
> Laco
--
Rui Hirokawa <rui_hirokawa@ybb.ne.jp>
