401 Authorize script doesn't work the way i'd like it

[frummel]

I found this script:
----------------
<?php

header('

http://WWW-Authenticate:

Basic realm=&quot;My Private Stuff&quot;');
header('Status: 401 Unauthorized');

// File Name: auth02.php

// Check to see if $PHP_AUTH_USER already contains info

if (!isset($PHP_AUTH_USER)) {

// If empty, send header causing dialog box to appear

echo 'Authorization Required.';
exit;

} else if (isset($PHP_AUTH_USER)) {

if (($PHP_AUTH_USER != &quot;admin&quot || ($PHP_AUTH_PW != &quot;letmein&quot) {

echo 'Authorization Required.';
exit;

} else {
echo &quot;
<P>You're authorized!</p>
&quot;;
}
}



?>

------------

The problem with this script is that the loginbox comes up, but I have to fill in the login-info 3 times because the popup returns twice after the first login.

I'd like the popup just once, and then the page i try to secure...

Anyone any ideas?

 

[sleipnir214]

I don't think you understand the logic of what it is you are trying to do. Maybe this rewrite will make it clearer:

<?php

function good_credentials ()
{
global $PHP_AUTH_USER, $PHP_AUTH_PW;

$retval = FALSE;

if (isset($PHP_AUTH_USER))
{
if (($PHP_AUTH_USER == &quot;admin&quot && ($PHP_AUTH_PW == &quot;letmein&quot)
{
$retval = TRUE;
}
}

return $retval;
}


function auth_header ()
{
header('

http://WWW-Authenticate:

Basic realm=&quot;My Private Stuff&quot;');
header('Status: 401 Unauthorized');
}



if (!good_credentials())
{
auth_header();
}
else
{
print &quot;Welcome!&quot;;
}
?> ______________________________________________________________________
Perfection in engineering does not happen when there is nothing more to add.
Rather it happens when there is nothing more to take away.

 

[frummel]

Hi there, thanks for your answer.. but now I have a different problem... a problem I had before..
When I try to open the page, i get the following message:

--------
Warning: Cannot add header information - headers already sent by (output started at /opt/guide/

http://www.blabla.net/HTML/pass/auth01.php:2)

in /opt/guide/

http://www.blabla.net/HTML/pass/auth01.php

on line 24

Warning: Cannot add header information - headers already sent by (output started at /opt/guide/

http://www.blabla.net/HTML/pass/auth01.php:2)

in /opt/guide/

http://www.blabla.net/HTML/pass/auth01.php

on line 25
--------

This means (from what i learned..) that the server has already sent a header, and the header generated by the page, comes too late. Therefor the header('Status: 401 unauthorized') must be at the top of the page...

 

[sleipnir214]

This from

http://www.php.net/manual/en/function.header.php

Remember that header() must be called before any actual output is sent, either by normal HTML tags, blank lines in a file, or from PHP. It is a very common error to read code with include(), or require(), functions, or another file access function, and have spaces or empty lines that are output before header() is called. The same problem exists when using a single PHP/HTML file. ______________________________________________________________________
Perfection in engineering does not happen when there is nothing more to add.
Rather it happens when there is nothing more to take away.

 

[frummel]

Hmmm... I have no idea what to do now....
What do you suggest?

 

[sleipnir214]

My code does not output a header in line 2. It only outputs a header in line 24.

What modifications have you made? ______________________________________________________________________
Perfection in engineering does not happen when there is nothing more to add.
Rather it happens when there is nothing more to take away.

 

[frummel]

I uploaded my old file........
There was the header still in line 2...
The script you rewrote was ok. It's working just fine!
Thanks for noticing!
There's just one thing I don't understand:

In the loginbox i get, there's this realm:
My Private Stuff-2312

Wow did the -2312 get there???

Oh and thanks for the time you took for helping me out!

 

[sleipnir214]

I have no idea where the &quot;-2312&quot; comes from.

On my server (Apache) running PHP 4.2.1, I get only the &quot;My Private Stuff&quot; part. That's with Opera, Mozilla, and IE. ______________________________________________________________________
Perfection in engineering does not happen when there is nothing more to add.
Rather it happens when there is nothing more to take away.

 

[frummel]

Weird... I have it on the following webpage:

http://www.nuedel.net/pass/auth06.php

and the phpinfo() can be found at

http://www.nuedel.net/phpinfo.php

It's an Apache 1.3.26 webserver on RedHat, With PHP/4.2.1

 

[sleipnir214]

If you are running my code, there is nothing there that could be doing it. I used the realm as a string literal.
______________________________________________________________________
Did you know?
The quality of our answers is directly proportional to the number of stars you vote?