Problem with WWW-Authenticate HTTP header

[Ian]

I'm hoping someome more knowledgeable than I can help me with a problem
I'm having. I have been writing a system using PHP and MySQL and had it
running for testing purposes on my own pc which is running Abyss web
server software.

Access to some of the website functionality is protected using the
following kind of call:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Realm name"');
header('HTTP/1.0 401 Unauthorized');
echo 'Text to send if user hits Cancel button';
exit;
} else {

And on my own pc this works fine both for me locally and for people
connecting over the internet. Any attempt to view the protected page
produces a username and password login prompt.

When I transfer the code onto commercially available webspace though I
get a problem in that the username and password login prompt appears but
irrespective of what I enter it just keeps reappearing and this has
nothing to do with the actual code which does one of 3 things: if the
username and password are valid continues to execute the PHP script and
HTML, if the username is invalid a message is produced saying invalid
login and the third option is that the user actually cancels their
login.

So my question is what might be causing this problem and is there a way
round it? I've spoken with the webspace provider but they had no answer
either.

[Graham J]

> I'm hoping someome more knowledgeable than I can help me with a problem

I'm having. I have been writing a system using PHP and MySQL and had it
running for testing purposes on my own pc which is running Abyss web
server software.
[...snip...]
When I transfer the code onto commercially available webspace though I
get a problem in that the username and password login prompt appears but
irrespective of what I enter it just keeps reappearing and this has
nothing to do with the actual code which does one of 3 things: if the
username and password are valid continues to execute the PHP script and
HTML, if the username is invalid a message is produced saying invalid
login and the third option is that the user actually cancels their
login.

So my question is what might be causing this problem and is there a way
round it? I've spoken with the webspace provider but they had no answer
either.

What web server software is used for the webspace? It seems that if it is
IIS you have a few extra hoops to jump through to make things work (which
you can Google for).

G.

[Ian]

On Fri, 17 Dec 2004 00:52:51 -0000, "Graham J" <ob*****@despammed.com>
wrote:

I'm hoping someome more knowledgeable than I can help me with a problem
I'm having. I have been writing a system using PHP and MySQL and had it
running for testing purposes on my own pc which is running Abyss web
server software.

[...snip...]

When I transfer the code onto commercially available webspace though I
get a problem in that the username and password login prompt appears but
irrespective of what I enter it just keeps reappearing and this has
nothing to do with the actual code which does one of 3 things: if the
username and password are valid continues to execute the PHP script and
HTML, if the username is invalid a message is produced saying invalid
login and the third option is that the user actually cancels their
login.

So my question is what might be causing this problem and is there a way
round it? I've spoken with the webspace provider but they had no answer
either.

What web server software is used for the webspace? It seems that if it is
IIS you have a few extra hoops to jump through to make things work (which
you can Google for).

G.

Seems to be Apache/1.3.33.

Ian.

[L�ʻie Techie]

On Fri, 17 Dec 2004 01:25:35 +0000, Ian wrote:

On Fri, 17 Dec 2004 00:52:51 -0000, "Graham J" <ob*****@despammed.com>
wrote:

What web server software is used for the webspace? It seems that if it
is IIS you have a few extra hoops to jump through to make things work
(which you can Google for).

G.

Seems to be Apache/1.3.33.

Ian.

Which version of PHP are you running at home and which version is on the
server?

La'ie Techie

[Ian]

On Fri, 17 Dec 2004 00:32:35 -0700, L??ie Techie
<laie@win_remove_get_nospam_solutions.com> wrote:

On Fri, 17 Dec 2004 01:25:35 +0000, Ian wrote:

On Fri, 17 Dec 2004 00:52:51 -0000, "Graham J" <ob*****@despammed.com>
wrote:

What web server software is used for the webspace? It seems that if it
is IIS you have a few extra hoops to jump through to make things work
(which you can Google for).

G.

Seems to be Apache/1.3.33.

Ian.

Which version of PHP are you running at home and which version is on the
server?

La'ie Techie

Version on the server is 4.3.9 and the version on my pc at home is
4.3.5.

Ian

[Graham J]

> >> Seems to be Apache/1.3.33.

Ian.

Which version of PHP are you running at home and which version is on the
server?

La'ie Techie

Version on the server is 4.3.9 and the version on my pc at home is
4.3.5.

I guess the next question is whether PHP is being run as CGI or as an Apache
module. The PHP manual suggests that HTTP Authentication doesn't work in
CGI mode though some users have reported that it does.

G.

[Ian]

On Fri, 17 Dec 2004 13:50:48 -0000, "Graham J" <ob*****@despammed.com>
wrote:

>> Seems to be Apache/1.3.33.
>>
>> Ian.
>
>Which version of PHP are you running at home and which version is on the
>server?
>
>La'ie Techie

Version on the server is 4.3.9 and the version on my pc at home is
4.3.5.

I guess the next question is whether PHP is being run as CGI or as an Apache
module. The PHP manual suggests that HTTP Authentication doesn't work in
CGI mode though some users have reported that it does.

G.

I've sent an email to the server provider asking whether their PHP is
implemented as CGI or Apache but I bet it's CGI and that's what's
causing the problem, thanks for the suggestion. I don't suppose you
know of any way round it ?

[Graham J]

> I've sent an email to the server provider asking whether their PHP is

implemented as CGI or Apache but I bet it's CGI and that's what's
causing the problem, thanks for the suggestion. I don't suppose you
know of any way round it ?

No, but then I've just been at a loose end and Googling out of curiosity!

I guess a lot depends on what you are trying to achieve. If it is just
password protection your webhost might allow the basic .htaccess method. If
you want to use MySQL for username and password lookup your webhost might
have installed mod_auth_mysql (not sure how likely this is). If you want to
do it for yourself then you have the option of writing your own
authentication system using HTML forms etc (or borrowing one that is already
written). Remember that HTTP Authentication can't really be called secure
by any means, unless on SSL connection, though if you are really just after
personalisation without high security it does the job fine.

[Ian]

On Fri, 17 Dec 2004 15:35:23 -0000, "Graham J" <ob*****@despammed.com>
wrote:

I've sent an email to the server provider asking whether their PHP is
implemented as CGI or Apache but I bet it's CGI and that's what's
causing the problem, thanks for the suggestion. I don't suppose you
know of any way round it ?

No, but then I've just been at a loose end and Googling out of curiosity!

I guess a lot depends on what you are trying to achieve. If it is just
password protection your webhost might allow the basic .htaccess method. If
you want to use MySQL for username and password lookup your webhost might
have installed mod_auth_mysql (not sure how likely this is). If you want to
do it for yourself then you have the option of writing your own
authentication system using HTML forms etc (or borrowing one that is already
written). Remember that HTTP Authentication can't really be called secure
by any means, unless on SSL connection, though if you are really just after
personalisation without high security it does the job fine.

Have just heard back from the server people who are telling me its
Apache and not CGI ?!?? But then they also mentioned that they are
running something called PHPsuexec which I will have to look into
further and I suppose could be the source of the problem.
Basically, I've already written all the PHP and HTML routines to read
from a MySQL user details file which based on their username and
password has lots of extra information in it that determines what they
can and can't do. I guess maybe the easiest thing to do is ignore the
HTTP-Authentication routine and replace it with an HTML form. Was just
that I'd never done this via a form before as the php header routine had
always worked previously. Thanks for your comments again.

[Nick Kew]

In article <dt********************************@4ax.com>,
Ian <ia*@nospam.com> writes:

Have just heard back from the server people who are telling me its
Apache and not CGI ?!?? But then they also mentioned that they are
running something called PHPsuexec which I will have to look into
further and I suppose could be the source of the problem.
You asked the wrong question. PHPsuexec is neither of the two
choices you offered them, but it's much closer to CGI. If you want
to do authentication, you'll have to treat it as CGI and use
CGI-based methods.
from a MySQL user details file which based on their username and
password has lots of extra information in it that determines what they
can and can't do.

Well that's trivial - all you need is the authenticated user name.

--
Nick Kew

[Ian]

On Fri, 17 Dec 2004 17:46:53 +0000, ni**@hugin.webthing.com (Nick Kew)
wrote:

In article <dt********************************@4ax.com>,
Ian <ia*@nospam.com> writes:

Have just heard back from the server people who are telling me its
Apache and not CGI ?!?? But then they also mentioned that they are
running something called PHPsuexec which I will have to look into
further and I suppose could be the source of the problem.

You asked the wrong question. PHPsuexec is neither of the two
choices you offered them, but it's much closer to CGI. If you want
to do authentication, you'll have to treat it as CGI and use
CGI-based methods.

Such as ?

[Ian]

On Fri, 17 Dec 2004 17:46:53 +0000, ni**@hugin.webthing.com (Nick Kew)
wrote:

In article <dt********************************@4ax.com>,
Ian <ia*@nospam.com> writes:

Have just heard back from the server people who are telling me its
Apache and not CGI ?!?? But then they also mentioned that they are
running something called PHPsuexec which I will have to look into
further and I suppose could be the source of the problem.

You asked the wrong question. PHPsuexec is neither of the two
choices you offered them, but it's much closer to CGI. If you want
to do authentication, you'll have to treat it as CGI and use
CGI-based methods.

No, I asked the right question which was can you tell me any reason why
HTTP-Authentication is not working on your server when I call it using
the following PHP script ....... THEN I asked them if they were using
PHP as cgi as I'd heard that can cause a problem. After telling me they
know very little about PHP I was subsequently asked if it might have
something to do with them using PHPsuexec.

[Brian]

Ian wrote:

I have been writing a system using PHP and MySQL and had it running
for testing purposes on my own pc which is running Abyss web server
software.
This is off-topic for an html www authoring group; you'll likely get a
more useful discussion in a better-suited group.
Access to some of the website functionality is protected using the
following kind of call:

<?php if (!isset($_SERVER['PHP_AUTH_USER'])) {

Why are you using PHP to handle auth when auth stuff is built into Apache?

--
Brian (remove "invalid" to email me)