# adding http digest authentication to php5

- Thread: https://externals.io/message/7454
- Original archive: https://news-web.php.net/php.internals/7454
- Started by Rui Hirokawa on 2004-02-01T14:30:40+00:00
- Messages: 5
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #7454 — Rui Hirokawa — 2004-02-01T14:30:40+00:00

URL: https://externals.io/message/7454#7454

Hi,

I just made a patch to add http digest authentication for php5
based on RFC2617.
It is not tested well yet, the attached sample script
'digest-auth.php' works with Mozilla Firebird 0.7.

It is useful or not ?

Rui

---

## #7455 — Rui Hirokawa — 2004-02-01T14:34:42+00:00

URL: https://externals.io/message/7454#7455 · In reply to: #7454

I forgot to attach a sample script.

Rui

> Hi,
> 
> I just made a patch to add http digest authentication for php5
> based on RFC2617.
> It is not tested well yet, the attached sample script
> 'digest-auth.php' works with Mozilla Firebird 0.7.
> 
> It is useful or not ?
> 
> Rui

---

## #7456 — Rui Hirokawa — 2004-02-01T14:36:47+00:00

URL: https://externals.io/message/7454#7456 · In reply to: #7455

Can I attach a php script ?

<?php // a sample for digest authentication
$realm="php-users";
$uri = $_SERVER['REQUEST_URI'];
$nonce = `time()`;

$username = "taro";
$password = "secret";

function auth_func() {
   global $realm, $nonce;

   header('HTTP/1.0 401 Unauthorized');
   header("WWW-authenticate: Digest realm=\"$realm\" nonce=\"$nonce\"");
   die('password or user name is invalid.');
}

if (empty($_SERVER['PHP_AUTH_USER'])) {
   auth_func();
} else {
   $username = $_SERVER['PHP_AUTH_USER'];
   $response = $_SERVER['PHP_AUTH_PW'];
   $nonce    = $_SERVER['PHP_AUTH_NONCE'];

   // response based on RFC2617
   $a1 = md5("$username:$realm:$password");
   $a2 = md5("GET:$uri");
   $response0 = md5("$a1:$nonce:$a2");

   print "response1:$response<br />";
   print "response0:$response0<br />";
   print "nonce:$nonce</br>";
   if ($response == $response0) {
     print "authenticated.<br />";
   } else {
     print "not authenticated.<br />";
   }
}
?

---

## #7457 — Pierre-Alain Joye — 2004-02-01T14:39:10+00:00

URL: https://externals.io/message/7454#7457 · In reply to: #7456

On Sun, 01 Feb 2004 23:36:47 +0900
Rui Hirokawa <rui_hirokawa@ybb.ne.jp> wrote:

> 
> Can I attach a php script ?

.txt only :)

pierre

---

## #7467 — Rui Hirokawa — 2004-02-01T23:11:55+00:00

URL: https://externals.io/message/7454#7467 · In reply to: #7454

I reallized this patch is not useful,
because
1. http 1.1 based client authentication method (qop, cnonce, nc) is
    not supported yet.
    array $_SERVER['PHP_AUTH_DIGEST'] having the elementes
    'nonce','qop','cnonce','nc' should be defined.
2. the order of parameters should be unknown.

I will use Thomas Pike's excellent implementation now.

Rui

Rui Hirokawa wrote:
> Hi,
> 
> I just made a patch to add http digest authentication for php5
> based on RFC2617.
> It is not tested well yet, the attached sample script
> 'digest-auth.php' works with Mozilla Firebird 0.7.
> 
> It is useful or not ?
> 
> Rui