DooDigestAuth php（后台）授权管理类 web浏览器授权
data
http
match
realm
<span> 1</span> <span>php
</span><span> 2</span><span>/*</span><span>*
</span><span> 3</span><span> * DooDigestAuth class file.
</span><span> 4</span><span> *
</span><span> 5</span><span> * @author Leng Sheng Hong <darkredz>
</darkredz></span><span> 6</span><span> * @link http://www.doophp.com/
</span><span> 7</span><span> * @copyright Copyright © 2009 Leng Sheng Hong
</span><span> 8</span><span> * @license http://www.doophp.com/license
</span><span> 9</span><span>*/</span><span> 10</span><span> 11</span><span>/*</span><span>*
</span><span> 12</span><span> * Handles HTTP digest authentication
</span><span> 13</span><span> *
</span><span> 14</span><span> * <p>HTTP digest authentication can be used with the URI router.
</p></span><span> 15</span><span> * HTTP digest is much more recommended over the use of HTTP Basic auth which doesn't provide any encryption.
</span><span> 16</span><span> * If you are running PHP on Apache in CGI/FastCGI mode, you would need to
</span><span> 17</span><span> * add the following line to your .htaccess for digest auth to work correctly.
</span><span> 18</span><span> * <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code>
</span><span> 19</span><span> *
</span><span> 20</span><span> * <p>This class is tested under Apache 2.2 and Cherokee web server. It should work in both mod_php and cgi mode.</p>
</span><span> 21</span><span> *
</span><span> 22</span><span> * @author Leng Sheng Hong <darkredz>
</darkredz></span><span> 23</span><span> * @version $Id: DooDigestAuth.php 1000 2009-07-7 18:27:22
</span><span> 24</span><span> * @package doo.auth
</span><span> 25</span><span> * @since 1.0
</span><span> 26</span><span>*/</span><span> 27</span><span>class</span><span> DooDigestAuth{
</span><span> 28</span><span> 29</span><span>/*</span><span>*
</span><span> 30</span><span> * Authenticate against a list of username and passwords.
</span><span> 31</span><span> *
</span><span> 32</span><span> * <p>HTTP Digest Authentication doesn't work with PHP in CGI mode,
</p></span><span> 33</span><span> * you have to add this into your .htaccess <code>RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]</code>
</span><span> 34</span><span> *
</span><span> 35</span><span> * @param string $realm Name of the authentication session
</span><span> 36</span><span> * @param array $users An assoc array of username and password: array('uname1'=>'pwd1', 'uname2'=>'pwd2')
</span><span> 37</span><span> * @param string $fail_msg Message to be displayed if the User cancel the login
</span><span> 38</span><span> * @param string $fail_url URL to be redirect if the User cancel the login
</span><span> 39</span><span> * @return string The username if login success.
</span><span> 40</span><span>*/</span><span> 41</span><span>public</span><span>static</span><span>function</span> http_auth(<span>$realm</span>, <span>$users</span>, <span>$fail_msg</span>=<span>NULL</span>, <span>$fail_url</span>=<span>NULL</span><span>){
</span><span> 42</span><span>$realm</span> = "Restricted area - <span>$realm</span>"<span>;
</span><span> 43</span><span> 44</span><span>//</span><span>user => password
</span><span> 45</span><span> //$users = array('admin' => '1234', 'guest' => 'guest');</span><span> 46</span><span>if</span>(!<span>empty</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION']) && <span>strpos</span>(<span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'], 'Digest')===0<span>){
</span><span> 47</span><span>$_SERVER</span>['PHP_AUTH_DIGEST'] = <span>$_SERVER</span>['REDIRECT_HTTP_AUTHORIZATION'<span>];
</span><span> 48</span><span> }
</span><span> 49</span><span> 50</span><span>if</span> (<span>empty</span>(<span>$_SERVER</span>['PHP_AUTH_DIGEST'<span>])) {
</span><span> 51</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 52</span> '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 53</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 54</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 55</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 56</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 57</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 58</span><span>exit</span><span>;
</span><span> 59</span><span> }
</span><span> 60</span><span> 61</span><span>//</span><span> analyze the PHP_AUTH_DIGEST variable</span><span> 62</span><span>if</span> (!(<span>$data</span> = self::http_digest_parse(<span>$_SERVER</span>['PHP_AUTH_DIGEST'])) || !<span>isset</span>(<span>$users</span>[<span>$data</span>['username'<span>]])){
</span><span> 63</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 64</span> '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 65</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 66</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 67</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 68</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 69</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 70</span><span>exit</span><span>;
</span><span> 71</span><span> }
</span><span> 72</span><span> 73</span><span>//</span><span> generate the valid response</span><span> 74</span><span>$A1</span> = <span>md5</span>(<span>$data</span>['username'] . ':' . <span>$realm</span> . ':' . <span>$users</span>[<span>$data</span>['username'<span>]]);
</span><span> 75</span><span>$A2</span> = <span>md5</span>(<span>$_SERVER</span>['REQUEST_METHOD'].':'.<span>$data</span>['uri'<span>]);
</span><span> 76</span><span>$valid_response</span> = <span>md5</span>(<span>$A1</span>.':'.<span>$data</span>['nonce'].':'.<span>$data</span>['nc'].':'.<span>$data</span>['cnonce'].':'.<span>$data</span>['qop'].':'.<span>$A2</span><span>);
</span><span> 77</span><span> 78</span><span>if</span> (<span>$data</span>['response'] != <span>$valid_response</span><span>){
</span><span> 79</span><span>header</span>('HTTP/1.1 401 Unauthorized'<span>);
</span><span> 80</span><span>header</span>('WWW-Authenticate: Digest realm="'.<span>$realm</span>.
<span> 81</span> '",qop="auth",n>uniqid().'",opaque="'.<span>md5</span>(<span>$realm</span>).'"'<span>);
</span><span> 82</span><span>if</span>(<span>$fail_msg</span>!=<span>NULL</span><span>)
</span><span> 83</span><span>die</span>(<span>$fail_msg</span><span>);
</span><span> 84</span><span>if</span>(<span>$fail_url</span>!=<span>NULL</span><span>)
</span><span> 85</span><span>die</span>("<script>window.location.href = '<span>$fail_url'</script>"<span>);
</span><span> 86</span><span>exit</span><span>;
</span><span> 87</span><span> }
</span><span> 88</span><span> 89</span><span>//</span><span> ok, valid username & password</span><span> 90</span><span>return</span><span>$data</span>['username'<span>];
</span><span> 91</span><span> }
</span><span> 92</span><span> 93</span><span>/*</span><span>*
</span><span> 94</span><span> * Method to parse the http auth header, works with IE.
</span><span> 95</span><span> *
</span><span> 96</span><span> * Internet Explorer returns a qop="xxxxxxxxxxx" in the header instead of qop=xxxxxxxxxxx as most browsers do.
</span><span> 97</span><span> *
</span><span> 98</span><span> * @param string $txt header string to parse
</span><span> 99</span><span> * @return array An assoc array of the digest auth session
</span><span>100</span><span>*/</span><span>101</span><span>private</span><span>static</span><span>function</span> http_digest_parse(<span>$txt</span><span>)
</span><span>102</span><span> {
</span><span>103</span><span>$res</span> = <span>preg_match</span>("/username=\"([^\"]+)\"/i", <span>$txt</span>, <span>$match</span><span>);
</span><span>104</span><span>$data</span>['username'] = (<span>isset</span>(<span>$match</span>[1]))?<span>$match</span>[1]:<span>null</span><span>;
</span><span>105</span><span>$res</span> = <span>preg_match</span>('/n/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>106</span><span>$data</span>['nonce'] = <span>$match</span>[1<span>];
</span><span>107</span><span>$res</span> = <span>preg_match</span>('/nc=([0-9]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>108</span><span>$data</span>['nc'] = <span>$match</span>[1<span>];
</span><span>109</span><span>$res</span> = <span>preg_match</span>('/cn/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>110</span><span>$data</span>['cnonce'] = <span>$match</span>[1<span>];
</span><span>111</span><span>$res</span> = <span>preg_match</span>('/qop=([^,]+)/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>112</span><span>$data</span>['qop'] = <span>str_replace</span>('"','',<span>$match</span>[1<span>]);
</span><span>113</span><span>$res</span> = <span>preg_match</span>('/uri=\"([^\"]+)\"/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>114</span><span>$data</span>['uri'] = <span>$match</span>[1<span>];
</span><span>115</span><span>$res</span> = <span>preg_match</span>('/resp/i', <span>$txt</span>, <span>$match</span><span>);
</span><span>116</span><span>$data</span>['response'] = <span>$match</span>[1<span>];
</span><span>117</span><span>return</span><span>$data</span><span>;
</span><span>118</span><span> }
</span><span>119</span><span>120</span><span>121</span> }登录后复制
调用方法:
<span>1</span><span>require_once</span>(<span>dirname</span>(<span>__FILE__</span>)."/DooDigestAuth.php"<span>);
</span><span>2</span> DooDigestAuth::http_auth('example.com', <span>array</span>('admin'=>"123456789"));登录后复制
phpweb授权登录可有效防止后台暴力破解
下载地址：http://files.cnblogs.com/files/func/DooDigestAuth.zip
以上就介绍了DooDigestAuth php（后台）授权管理类 web浏览器授权，包括了方面的内容，希望对PHP教程有兴趣的朋友有所帮助。
本站声明
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系admin@php.cn
热AI工具
Undresser.AI Undress
人工智能驱动的应用程序，用于创建逼真的裸体照片
AI Clothes Remover
用于从照片中去除衣服的在线人工智能工具。
Undress AI Tool
免费脱衣服图片
Clothoff.io
AI脱衣机
AI Hentai Generator
免费生成ai无尽的。
热门文章
R.E.P.O.能量晶体解释及其做什么（黄色晶体）
1 个月前
By 尊渡假赌尊渡假赌尊渡假赌
R.E.P.O.最佳图形设置
1 个月前
By 尊渡假赌尊渡假赌尊渡假赌
刺客信条阴影：贝壳谜语解决方案
3 周前
By DDD
Windows 11 KB5054979中的新功能以及如何解决更新问题
2 周前
By DDD
威尔R.E.P.O.有交叉游戏吗？
1 个月前
By 尊渡假赌尊渡假赌尊渡假赌
热工具
记事本++7.3.1
好用且免费的代码编辑器
SublimeText3汉化版
中文版，非常好用
禅工作室 13.0.1
功能强大的PHP集成开发环境
Dreamweaver CS6
视觉化网页开发工具
SublimeText3 Mac版
神级代码编辑软件(SublimeText3)
热门话题
http状态码520是什么意思
Oct 13, 2023 pm 03:11 PM
http状态码520是指服务器在处理请求时遇到了一个未知的错误，无法提供更具体的信息。用于表示服务器在处理请求时发生了一个未知的错误，可能是由于服务器配置问题、网络问题或其他未知原因导致的。通常是由服务器配置问题、网络问题、服务器过载或代码错误等原因导致的。如果遇到状态码520错误，最好联系网站管理员或技术支持团队以获取更多的信息和帮助。
http状态码403是什么
Oct 07, 2023 pm 02:04 PM
http状态码403是服务器拒绝了客户端的请求的意思。解决http状态码403的方法是：1、检查身份验证凭据，如果服务器要求身份验证，确保提供正确的凭据；2、检查IP地址限制，如果服务器对IP地址进行了限制，确保客户端的IP地址被列入白名单或未列入黑名单；3、检查文件权限设置，如果403状态码与文件或目录的权限设置有关，确保客户端具有足够的权限访问这些文件或目录等等。
理解网页重定向的常见应用场景并了解HTTP301状态码
Feb 18, 2024 pm 08:41 PM
掌握HTTP301状态码的含义：网页重定向的常见应用场景随着互联网的迅猛发展，人们对网页交互的要求也越来越高。在网页设计领域，网页重定向是一种常见且重要的技术，通过HTTP301状态码来实现。本文将探讨HTTP301状态码的含义以及在网页重定向中的常见应用场景。HTTP301状态码是指永久重定向（PermanentRedirect）。当服务器接收到客户端发
如何使用Nginx Proxy Manager实现HTTP到HTTPS的自动跳转
Sep 26, 2023 am 11:19 AM
如何使用NginxProxyManager实现HTTP到HTTPS的自动跳转随着互联网的发展，越来越多的网站开始采用HTTPS协议来加密传输数据，以提高数据的安全性和用户的隐私保护。由于HTTPS协议需要SSL证书的支持，因此在部署HTTPS协议时需要有一定的技术支持。Nginx是一款强大且常用的HTTP服务器和反向代理服务器，而NginxProxy
使用http.PostForm函数发送带有表单数据的POST请求
Jul 25, 2023 pm 10:51 PM
使用http.PostForm函数发送带有表单数据的POST请求在Go语言的http包中，可以使用http.PostForm函数发送带有表单数据的POST请求。http.PostForm函数的原型如下：funcPostForm(urlstring,dataurl.Values)(resp*http.Response,errerror)其中，u
快速应用：PHP 异步 HTTP 下载多个文件的实用开发案例分析
Sep 12, 2023 pm 01:15 PM
快速应用：PHP异步HTTP下载多个文件的实用开发案例分析随着互联网的发展，文件下载功能已成为很多网站和应用程序的基本需求之一。而对于需要同时下载多个文件的场景，传统的同步下载方式往往效率低下且耗费时间。为此，使用PHP异步HTTP下载多个文件成为了一种越来越常见的解决方案。本文将通过一个实际的开发案例，详细分析如何使用PHP异步HTTP
C#中常见的网络通信和安全性问题及解决方法
Oct 09, 2023 pm 09:21 PM
C#中常见的网络通信和安全性问题及解决方法在当今互联网时代，网络通信已经成为了软件开发中必不可少的一部分。在C#中，我们通常会遇到一些网络通信的问题，例如数据传输的安全性、网络连接的稳定性等。本文将针对C#中常见的网络通信和安全性问题进行详细讨论，并提供相应的解决方法和代码示例。一、网络通信问题网络连接中断：网络通信过程中，可能会出现网络连接的中断，这会导致
http请求415错误解决方法
Nov 14, 2023 am 10:49 AM
解决方法：1、检查请求头中的Content-Type；2、检查请求体中的数据格式；3、使用适当的编码格式；4、使用适当的请求方法；5、检查服务器端的支持情况。
