PHP - HTTP Digest Authentication - Understanding Code Help

Posted on 16th Feb 2014 07:03 pm by admin

Hi Everyone,

This is my first time on your website and please excuse if I am asking silly question.

I have a question about PHP HTTP DIGEST AUTHENTICATION - published in PHP Manual - php.net
Their explanation is bit limited and I was unable to find anything about it on the web - People have written that
it's beyond the knowledge of the language and just paste the code and use it. But I have still done some study on the regular expression used and managed to understand it but please help me in understanding it completely.

The code which I need to be explained is in Blue color.

I will thank u in advance



/////////////////////////////////////////////////////////////////////////////////////////////////////////////
<?php
$realm = 'Restricted area';

//user => password
$users = array('admin' => 'mypass', 'guest' => 'guest');


if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Digest realm="'.$realm.
'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');

die('Text to send if user hits Cancel button');
}


// analyze the PHP_AUTH_DIGEST variable
if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
!isset($users[$data['username']]))
die('Wrong Credentials!');


// generate the valid response
$A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);

if ($data['response'] != $valid_response)
die('Wrong Credentials!');

// ok, valid username & password
echo 'Your are logged in as: ' . $data['username'];


// function to parse the http auth header
function http_digest_parse($txt)
{
// protect against missing data
$needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
$data = array();
$keys = implode('|', array_keys($needed_parts));

print $txt;

$txt - Below code shows the values which I received from the server - To check whats coming from the server
username="guest",realm="Restricted area",nonce="4b20d54ab440a",uri="/http.php",cnonce="e6fd095f85a80f1e68f3c2685119b35c",nc=00000001,response="ebaa40b07e3da56e89b048a9766fd4db",qop="auth",opaque="cdce8a5c95a1427d74df7acbf41c9ce0"Your are logged in as: guest

preg_match_all('@(' . $keys . ')=(?[' "])([^2]+?)2|([^s,]+))@', $txt, $matches, PREG_SET_ORDER);

My Understanding of the preg match all code above -


Preg_match_all is used to capture strings which have been matched by the above pattern. @ - means don't report any error on this. ' .$keys. ' have been imploded with a (pipe '|' also called or ) and because of implode function usage the keys values are 'nonce|nc|cnonce|qop|username|uri|username' .

Now the pattern looks for = sign .

Than parentheses comes with ?: non capturing parentheses means that it can be captured but it cannot be counted - at the time of using backrefrence.

Now 2 parentheses comes along ([' "]) with a character class and ' (not very sure about this) -Please confirm if correct - but i think it's escaped so that
we can capture ' or " -as you can see from the above $txt variable username has a value "guest".

Now we get to the third parentheses which is ([^2])+ - which I think is using negation with a back refrence , so we go back to the 2 parentheses because of 2 and look for another
" not start with what was matched in 2 parentheses with +(one or more) and than another parentheses with )?(option sign in the end to tell if its not really needed but optional) and another backrefrence
2 which takes back to ([' "]) and says find " and yes it "guest" is found without the quotes and is saved in the matches.

Now I am confused at this very much | (represented as "pipe" or "or") I think its to do something with the keys which were imploded earlier - look at the $key variable after imploding - Whats the use of this don't know and in what context it's being used don't know. And the last parentheses ([^s,]+) says dont capture anthing thats whitespace and , with + sign (One or more)

Please can someone tell whether I have got the above understanding correct and what mistakes I have made in my understanding.




foreach ($matches as $m) {
$data[$m[1]] = $m[3] ? $m[3] : $m[4];
unset($needed_parts[$m[1]]);
}

return $needed_parts ? false : $data;}

The above blue code explanation will also be much appreciated.

?>

Your Answer:

Login to answer

Other forums

PHP loop
Okay so I have several "articles" stored in a mysql database and am attempting to echo tho

Simple PHP/Java Help..
Hi,
I'm trying to build a little program to do with calculating postage. Unfortunately i haven't

Parse error: syntax error, unexpected $end in
hello,
i receive the error :Parse error: syntax error, unexpected $end in C:xamppxampphtdocsh

Production Order Enterprise Service to Manufacturing Exctn Sys (MES) ???
Hello Experts,

In our current landscape SAP ECC 5.0 is integrated to MES system via PI 7.

Querying info from one table based on info in another
Hi, I am currently trying to make a part for my user driven website where one user can subscribe to

Sending an SMS Message with ASP.NET
Often times it may be a requirement for your web application to send an SMS message. Such examples w

values in array being escaped
I would like to submit some values - back to the same form for checking before processing...

PHP4 to PHP5 Conversion
Hi Everyone,

I am working on a site that is built up on PHP4 and each page is being started f

sendmail code suddenly not working
Hi Guys, I maintain 3 sites (including my own) I use the following code from a french webmaster that

upgrade from 4.7 to ECC 6.0
Hi all,
we are going to do an upgrade from R/3 4.7 to ECC 6.0. I need to know if i can find som