PHP - HTTP Digest Authentication - Understanding Code Help

Posted on 16th Feb 2014 07:03 pm by admin

Hi Everyone,

This is my first time on your website and please excuse if I am asking silly question.

I have a question about PHP HTTP DIGEST AUTHENTICATION - published in PHP Manual - php.net
Their explanation is bit limited and I was unable to find anything about it on the web - People have written that
it's beyond the knowledge of the language and just paste the code and use it. But I have still done some study on the regular expression used and managed to understand it but please help me in understanding it completely.

The code which I need to be explained is in Blue color.

I will thank u in advance



/////////////////////////////////////////////////////////////////////////////////////////////////////////////
<?php
$realm = 'Restricted area';

//user => password
$users = array('admin' => 'mypass', 'guest' => 'guest');


if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Digest realm="'.$realm.
'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');

die('Text to send if user hits Cancel button');
}


// analyze the PHP_AUTH_DIGEST variable
if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
!isset($users[$data['username']]))
die('Wrong Credentials!');


// generate the valid response
$A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);

if ($data['response'] != $valid_response)
die('Wrong Credentials!');

// ok, valid username & password
echo 'Your are logged in as: ' . $data['username'];


// function to parse the http auth header
function http_digest_parse($txt)
{
// protect against missing data
$needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
$data = array();
$keys = implode('|', array_keys($needed_parts));

print $txt;

$txt - Below code shows the values which I received from the server - To check whats coming from the server
username="guest",realm="Restricted area",nonce="4b20d54ab440a",uri="/http.php",cnonce="e6fd095f85a80f1e68f3c2685119b35c",nc=00000001,response="ebaa40b07e3da56e89b048a9766fd4db",qop="auth",opaque="cdce8a5c95a1427d74df7acbf41c9ce0"Your are logged in as: guest

preg_match_all('@(' . $keys . ')=(?[' "])([^2]+?)2|([^s,]+))@', $txt, $matches, PREG_SET_ORDER);

My Understanding of the preg match all code above -


Preg_match_all is used to capture strings which have been matched by the above pattern. @ - means don't report any error on this. ' .$keys. ' have been imploded with a (pipe '|' also called or ) and because of implode function usage the keys values are 'nonce|nc|cnonce|qop|username|uri|username' .

Now the pattern looks for = sign .

Than parentheses comes with ?: non capturing parentheses means that it can be captured but it cannot be counted - at the time of using backrefrence.

Now 2 parentheses comes along ([' "]) with a character class and ' (not very sure about this) -Please confirm if correct - but i think it's escaped so that
we can capture ' or " -as you can see from the above $txt variable username has a value "guest".

Now we get to the third parentheses which is ([^2])+ - which I think is using negation with a back refrence , so we go back to the 2 parentheses because of 2 and look for another
" not start with what was matched in 2 parentheses with +(one or more) and than another parentheses with )?(option sign in the end to tell if its not really needed but optional) and another backrefrence
2 which takes back to ([' "]) and says find " and yes it "guest" is found without the quotes and is saved in the matches.

Now I am confused at this very much | (represented as "pipe" or "or") I think its to do something with the keys which were imploded earlier - look at the $key variable after imploding - Whats the use of this don't know and in what context it's being used don't know. And the last parentheses ([^s,]+) says dont capture anthing thats whitespace and , with + sign (One or more)

Please can someone tell whether I have got the above understanding correct and what mistakes I have made in my understanding.




foreach ($matches as $m) {
$data[$m[1]] = $m[3] ? $m[3] : $m[4];
unset($needed_parts[$m[1]]);
}

return $needed_parts ? false : $data;}

The above blue code explanation will also be much appreciated.

?>

Your Answer:

Login to answer

Other forums

PHP5 - Verifying a secure mail is secure
I need to send an e-mail from a form to a external department and because it contains personal custo

How to file_get_contents when login required?
Hello!

I am trying to read data from a page that you have to be logged into to view, I am try

help with php
It's not displaying or pulling anything out of the database.


Code: <html><

A little help in c#
i am doing a simple paint program using c# i want to draw with the mouse so i wrote the code of the

retrieving policy name inside the function called by this particular policy
Hi there,

I've playing around with dbms_rls package, trying to set up some security repo

count only commas outside parenteses
I have a sql table containing
id - query - query name
the first page contains a drop down men

Upload file!
Ok i have a form..
Code: <form name="form1" method="post" action=&quo

help need on ob_start()
Hi

I am a newbie in php, I have a code
Line number On/Off | Expand/Contract <?phpo

[RESOLVED] Socket/Port remains open after app crashes
I'm having this problem with a networked app in vb.net.

If the program exits normally the por

Something Non-Traditional. Can we solve?
I have an idea for an application here. It's mostly flash, but it couldn't work without a somewhat n