PHP - HTTP Digest Authentication - Understanding Code Help

Posted on 16th Feb 2014 07:03 pm by admin

Hi Everyone,

This is my first time on your website and please excuse if I am asking silly question.

I have a question about PHP HTTP DIGEST AUTHENTICATION - published in PHP Manual - php.net
Their explanation is bit limited and I was unable to find anything about it on the web - People have written that
it's beyond the knowledge of the language and just paste the code and use it. But I have still done some study on the regular expression used and managed to understand it but please help me in understanding it completely.

The code which I need to be explained is in Blue color.

I will thank u in advance



/////////////////////////////////////////////////////////////////////////////////////////////////////////////
<?php
$realm = 'Restricted area';

//user => password
$users = array('admin' => 'mypass', 'guest' => 'guest');


if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Digest realm="'.$realm.
'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');

die('Text to send if user hits Cancel button');
}


// analyze the PHP_AUTH_DIGEST variable
if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
!isset($users[$data['username']]))
die('Wrong Credentials!');


// generate the valid response
$A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);

if ($data['response'] != $valid_response)
die('Wrong Credentials!');

// ok, valid username & password
echo 'Your are logged in as: ' . $data['username'];


// function to parse the http auth header
function http_digest_parse($txt)
{
// protect against missing data
$needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
$data = array();
$keys = implode('|', array_keys($needed_parts));

print $txt;

$txt - Below code shows the values which I received from the server - To check whats coming from the server
username="guest",realm="Restricted area",nonce="4b20d54ab440a",uri="/http.php",cnonce="e6fd095f85a80f1e68f3c2685119b35c",nc=00000001,response="ebaa40b07e3da56e89b048a9766fd4db",qop="auth",opaque="cdce8a5c95a1427d74df7acbf41c9ce0"Your are logged in as: guest

preg_match_all('@(' . $keys . ')=(?[' "])([^2]+?)2|([^s,]+))@', $txt, $matches, PREG_SET_ORDER);

My Understanding of the preg match all code above -


Preg_match_all is used to capture strings which have been matched by the above pattern. @ - means don't report any error on this. ' .$keys. ' have been imploded with a (pipe '|' also called or ) and because of implode function usage the keys values are 'nonce|nc|cnonce|qop|username|uri|username' .

Now the pattern looks for = sign .

Than parentheses comes with ?: non capturing parentheses means that it can be captured but it cannot be counted - at the time of using backrefrence.

Now 2 parentheses comes along ([' "]) with a character class and ' (not very sure about this) -Please confirm if correct - but i think it's escaped so that
we can capture ' or " -as you can see from the above $txt variable username has a value "guest".

Now we get to the third parentheses which is ([^2])+ - which I think is using negation with a back refrence , so we go back to the 2 parentheses because of 2 and look for another
" not start with what was matched in 2 parentheses with +(one or more) and than another parentheses with )?(option sign in the end to tell if its not really needed but optional) and another backrefrence
2 which takes back to ([' "]) and says find " and yes it "guest" is found without the quotes and is saved in the matches.

Now I am confused at this very much | (represented as "pipe" or "or") I think its to do something with the keys which were imploded earlier - look at the $key variable after imploding - Whats the use of this don't know and in what context it's being used don't know. And the last parentheses ([^s,]+) says dont capture anthing thats whitespace and , with + sign (One or more)

Please can someone tell whether I have got the above understanding correct and what mistakes I have made in my understanding.




foreach ($matches as $m) {
$data[$m[1]] = $m[3] ? $m[3] : $m[4];
unset($needed_parts[$m[1]]);
}

return $needed_parts ? false : $data;}

The above blue code explanation will also be much appreciated.

?>

Your Answer:

Login to answer

Other forums

FlashVar function how to insert variables
Hi guys. Im new in this forum and also new in php programming. Can you help me about this code?
<

php unable to sent email
Hi, guys, I try to send a email through php but unfortunately the mail unable to sent. Here is my co

Using cURL to PUT
Can somebody help with the correct php code to make a cURL PUT request. Here is a sample of code bel

Javascript or not?
How many people prefer javascript/ajax sites? How many prefer the good old fashion straight php sit

Strange Oracle Query problem
Ok So I have this PHP class that talks to a Javascript class that basically creates a table of infor

(sub)screen resize modification doesn't work after ECC 6 EhP 4 installation
Hello,

We have previously extended the size of the custom data tab on PO transaction ME23

show the direct link into href
I want to display link on the page. i am fetching the data(URL) from database,actually before that i

ClientScript.RegisterClientScriptBlock Issue
This is what I haveview plaincopy to clipboardprint?Protected Sub posrback_Click(ByVal sender As Obj

Change image filetype on upload?
Hi,
I've got a form which uploads an image to the server.
Is it possible to change the image t

Delete all files in folder except with certain name
I have a script that I want to delete all files in a folder (taken from a database) except for one n