Gemeinschaft Lernen Tools-Bibliothek Freizeit
suchen
Deutsch
Heim > Backend-Entwicklung > PHP-Tutorial > DooDigestAuth PHP (Backend) Autorisierungsverwaltungsklasse Webbrowser-Autorisierung

DooDigestAuth PHP (Backend) Autorisierungsverwaltungsklasse Webbrowser-Autorisierung

WBOY
Freigeben： 2016-07-29 09:15:38
Original
721 Leute haben es durchsucht

<span>  1</span> <?<span>php
</span><span>  2</span><span>/*</span><span>*
</span><span>  3</span><span> * DooDigestAuth class file.
</span><span>  4</span><span> *
</span><span>  5</span><span> * @author Leng Sheng Hong <darkredz@gmail.com>
<span>  6</span><span> * @link http://www.doophp.com/
</span><span>  7</span><span> * @copyright Copyright &copy; 2009 Leng Sheng Hong
</span><span>  8</span><span> * @license http://www.doophp.com/license
</span><span>  9</span><span>*/</span><span> 10</span><span> 11</span><span>/*</span><span>*
</span><span> 12</span><span> * Handles HTTP digest authentication
</span><span> 13</span><span> *
</span><span> 14</span><span> * <p>HTTP digest authentication can be used with the URI router.
</span><span> 15</span><span> * HTTP digest is much more recommended over the use of HTTP Basic auth which doesn't provide any encryption.
</span><span> 16</span><span> * If you are running PHP on Apache in CGI/FastCGI mode, you would need to
</span><span> 17</span><span> * add the following line to your .htaccess for digest auth to work correctly.</p>
</span><span> 18</span><span> * <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code>
</span><span> 19</span><span> *
</span><span> 20</span><span> * <p>This class is tested under Apache 2.2 and Cherokee web server. It should work in both mod_php and cgi mode.</p>
</span><span> 21</span><span> *
</span><span> 22</span><span> * @author Leng Sheng Hong <darkredz@gmail.com>
</span><span> 23</span><span> * @version $Id: DooDigestAuth.php 1000 2009-07-7 18:27:22
</span><span> 24</span><span> * @package doo.auth
</span><span> 25</span><span> * @since 1.0
</span><span> 26</span><span>*/</span><span> 27</span><span>class</span><span> DooDigestAuth{
</span><span> 28</span><span> 29</span><span>/*</span><span>*
</span><span> 30</span><span>     * Authenticate against a list of username and passwords.
</span><span> 31</span><span>     *
</span><span> 32</span><span>     * <p>HTTP Digest Authentication doesn't work with PHP in CGI mode,
</span><span> 33</span><span>     * you have to add this into your .htaccess <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code></p>
</span><span> 34</span><span>     *
</span><span> 35</span><span>     * @param string $realm Name of the authentication session
</span><span> 36</span><span>     * @param array $users An assoc array of username and password: array('uname1'=>'pwd1', 'uname2'=>'pwd2')
</span><span> 37</span><span>     * @param string $fail_msg Message to be displayed if the User cancel the login
</span><span> 38</span><span>     * @param string $fail_url URL to be redirect if the User cancel the login
</span><span> 39</span><span>     * @return string The username if login success.
</span><span> 40</span><span>*/</span><span> 41</span><span>public</span><span>static</span><span>function</span> http_auth(<span>$realm</span>, <span>$users</span>, <span>$fail_msg</span>=<span>NULL</span>, <span>$fail_url</span>=<span>NULL</span><span>){
</span><span> 42</span><span>$realm</span> = "Restricted area - <span>$realm</span>"<span>;
</span><span> 43</span><span> 44</span><span>//</span><span>user => password
</span><span> 45</span><span>        //$users = array('admin' => '1234', 'guest' => 'guest');</span><span> 46</span><span>if</span>(!<span>empty</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION']) && <span>strpos</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'], 'Digest')===0<span>){
</span><span> 47</span><span>$_SERVER</span>['PHP_AUTH_DIGEST'] = <span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'<span>];
</span><span> 48</span><span>        }
</span><span> 49</span><span> 50</span><span>if</span> (<span>empty</span>(<span>$_SERVER</span>['PHP_AUTH_DIGEST'<span>])) {
</span><span> 51</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 52</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 53</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 54</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 55</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 56</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 57</span><span>die</span>("<script>window.location.href = '<span>$fail_url</span>'</script>"<span>);
</span><span> 58</span><span>exit</span><span>;
</span><span> 59</span><span>        }
</span><span> 60</span><span> 61</span><span>//</span><span> analyze the PHP_AUTH_DIGEST variable</span><span> 62</span><span>if</span> (!(<span>$data</span> = self::http_digest_parse(<span>$_SERVER</span>['PHP_AUTH_DIGEST'])) || !<span>isset</span>(<span>$users</span>[<span>$data</span>['username'<span>]])){
</span><span> 63</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 64</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 65</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 66</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 67</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 68</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 69</span><span>die</span>("<script>window.location.href = '<span>$fail_url</span>'</script>"<span>);
</span><span> 70</span><span>exit</span><span>;
</span><span> 71</span><span>        }
</span><span> 72</span><span> 73</span><span>//</span><span> generate the valid response</span><span> 74</span><span>$A1</span> = <span>md5</span>(<span>$data</span>['username'] . ':' . <span>$realm</span> . ':' . <span>$users</span>[<span>$data</span>['username'<span>]]);
</span><span> 75</span><span>$A2</span> = <span>md5</span>(<span>$_SERVER</span>['REQUEST_METHOD'].':'.<span>$data</span>['uri'<span>]);
</span><span> 76</span><span>$valid_response</span> = <span>md5</span>(<span>$A1</span>.':'.<span>$data</span>['nonce'].':'.<span>$data</span>['nc'].':'.<span>$data</span>['cnonce'].':'.<span>$data</span>['qop'].':'.<span>$A2</span><span>);
</span><span> 77</span><span> 78</span><span>if</span> (<span>$data</span>['response'] != <span>$valid_response</span><span>){
</span><span> 79</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 80</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 81</span>                    '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 82</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 83</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 84</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 85</span><span>die</span>("<script>window.location.href = '<span>$fail_url</span>'</script>"<span>);
</span><span> 86</span><span>exit</span><span>;
</span><span> 87</span><span>        }
</span><span> 88</span><span> 89</span><span>//</span><span> ok, valid username & password</span><span> 90</span><span>return</span><span>$data</span>['username'<span>];
</span><span> 91</span><span>    }
</span><span> 92</span><span> 93</span><span>/*</span><span>*
</span><span> 94</span><span>     * Method to parse the http auth header, works with IE.
</span><span> 95</span><span>     *
</span><span> 96</span><span>     * Internet Explorer returns a qop="xxxxxxxxxxx" in the header instead of qop=xxxxxxxxxxx as most browsers do.
</span><span> 97</span><span>     *
</span><span> 98</span><span>     * @param string $txt header string to parse
</span><span> 99</span><span>     * @return array An assoc array of the digest auth session
</span><span>100</span><span>*/</span><span>101</span><span>private</span><span>static</span><span>function</span> http_digest_parse(<span>$txt</span><span>)
</span><span>102</span><span>    {
</span><span>103</span><span>$res</span> = <span>preg_match</span>("/username=\"([^\"]+)\"/i", <span>$txt</span>, <span>$match</span><span>);
</span><span>104</span><span>$data</span>['username'] = (<span>isset</span>(<span>$match</span>[1]))?<span>$match</span>[1]:<span>null</span><span>;
</span><span>105</span><span>$res</span> = <span>preg_match</span>('/n/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>106</span><span>$data</span>['nonce'] = <span>$match</span>[1<span>];
</span><span>107</span><span>$res</span> = <span>preg_match</span>('/nc=([0-9]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>108</span><span>$data</span>['nc'] = <span>$match</span>[1<span>];
</span><span>109</span><span>$res</span> = <span>preg_match</span>('/cn/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>110</span><span>$data</span>['cnonce'] = <span>$match</span>[1<span>];
</span><span>111</span><span>$res</span> = <span>preg_match</span>('/qop=([^,]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>112</span><span>$data</span>['qop'] = <span>str_replace</span>('"','',<span>$match</span>[1<span>]);
</span><span>113</span><span>$res</span> = <span>preg_match</span>('/uri=\"([^\"]+)\"/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>114</span><span>$data</span>['uri'] = <span>$match</span>[1<span>];
</span><span>115</span><span>$res</span> = <span>preg_match</span>('/resp/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>116</span><span>$data</span>['response'] = <span>$match</span>[1<span>];
</span><span>117</span><span>return</span><span>$data</span><span>;
</span><span>118</span><span>    }
</span><span>119</span><span>120</span><span>121</span> }
Nach dem Login kopieren

Aufrufmethode: 

<span>1</span><span>require_once</span>(<span>dirname</span>(<span>__FILE__</span>)."/DooDigestAuth.php"<span>);
</span><span>2</span> DooDigestAuth::http_auth('example.com', <span>array</span>('admin'=>"123456789"));
Nach dem Login kopieren

Mit der phpweb-autorisierten Anmeldung kann Brute-Force-Cracking im Hintergrund effektiv verhindert werden

Download-Adresse: http://files.cnblogs.com/files/func/DooDigestAuth.zip

Das Obige stellt die Webbrowser-Autorisierung der DooDigestAuth PHP (Backend)-Autorisierungsklasse vor, einschließlich des Inhalts. Ich hoffe, dass es für Freunde hilfreich ist, die an PHP-Tutorials interessiert sind.

Verwandte Etiketten：
data http match realm
Quelle：php.cn
Vorheriger Artikel：Die OneThink-Datenbankverbindung schlägt fehl und meldet immer, dass das Passwort falsch ist. Nächster Artikel：PHP-Second-Level-Domainnamen-Sitzung und Cookie-Sharing-Plan
Erklärung dieser Website
Der Inhalt dieses Artikels wird freiwillig von Internetnutzern beigesteuert und das Urheberrecht liegt beim ursprünglichen Autor. Diese Website übernimmt keine entsprechende rechtliche Verantwortung. Wenn Sie Inhalte finden, bei denen der Verdacht eines Plagiats oder einer Rechtsverletzung besteht, wenden Sie sich bitte an admin@php.cn
Neueste Artikel des Autors
Aktuelle Ausgaben
function_exists() kann die benutzerdefinierte Funktion nicht ermitteln Funktionstest () {Verwendung der Verwendung durch -Durch -Durch -Durch -Durch -Durch -Durc...
Aus 2024-04-29 11:01:01
0
3
2038
So zeigen Sie die mobile Version von Google Chrome an Hallo Lehrer, wie kann ich Google Chrome in eine mobile Version umwandeln?
Aus 2024-04-23 00:22:19
0
11
2197
Das untergeordnete Fenster bedient das übergeordnete Fenster, aber die Ausgabe antwortet nicht. Die ersten beiden Sätze sind ausführbar, der letzte Satz jedoch nicht.
Aus 2024-04-19 15:37:47
0
1
1851
Im übergeordneten Fenster erfolgt keine Ausgabe document.onclick = function(){ window.opener.document.write('Ich bin die Ausgabe des unter...
Aus 2024-04-18 23:52:34
0
1
1744
Wo gibt es die Kursunterlagen zum CSS-Mindmapping? Kursunterlagen
Aus 2024-04-16 10:10:18
0
0
1763
verwandte Themen
Mehr>
Beliebte Empfehlungen
Beliebte Tutorials
Mehr>
Verwandte Tutorials
Beliebte Empfehlungen
Aktuelle Kurse
Neueste Downloads
Mehr>
Web-Effekte
Quellcode der Website
Website-Materialien
Frontend-Vorlage