'Using basic http auth to pass auth to a REST API call, how to reprompt for a user/pass when first attempt was incorrect?
Using the following HTTP Basic Authentication with PHP to prompt the user for a username/password which is then passed to a REST API call to start or stop a process. As written this works, as long as the user enters the correct username & password. However, if the the wrong password is entered an ldap bad-password response is received as the result from the API, and if the user reloads the page or clicks the previous and clicks the link to go to this page again, user immediately gets the same "password incorrect" message as PHP_AUTH_USER apparently can't be reset. What am I missing - is there a way to instruct the browser to prompt the user for username/password again?
<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="My Realm"');
header('HTTP/1.0 401 Unauthorized');
echo 'User cancelled auth attempt';
exit;
} else {
$action = $_GET["action"];
$hn = gethostname();
$login = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
$url = "https://" . $hn . ":4567/api/servers/foo/bar/" . $action;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, "$login:$password");
$result = curl_exec($ch);
curl_close($ch);
echo($result);
}
?>
Thanks for any tips!
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
