[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache #3551

kepten · 2012-03-10T17:25:44Z

Bug fix: yes
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: #1813
Todo: -

In order to work, add this to the .htaccess:

RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ app.php [QSA,L]

stof · 2012-03-10T17:33:40Z

src/Symfony/Component/HttpFoundation/ServerBag.php

+
+        // Decode AUTHORIZATION header into PHP_AUTH_USER and PHP_AUTH_PW
+        if ($authorization_header && (!isset($this->parameters['PHP_AUTH_USER']) || !isset($this->parameters['PHP_AUTH_PW']))) {
+                list($this->parameters['PHP_AUTH_USER'], $this->parameters['PHP_AUTH_PW']) = explode(':' , base64_decode(substr($authorization_header, 6)));


the indentation should use 4 spaces, not 8

and instead modifying $this->parameters, I would modify $parameters before calling the parent constructor

you should also use camelCase variable names ($authorizationHeader instead of $authorization_header).

how did I miss that ? 😳

I think I want a badge for that!

stof · 2012-03-10T17:34:26Z

you should also add a unit test for this

kepten · 2012-03-11T15:34:04Z

Thanks for the feedback, I committed the changes.

Tobion · 2012-03-11T16:08:56Z

src/Symfony/Component/HttpFoundation/ServerBag.php

@@ -19,6 +19,26 @@
 */
 class ServerBag extends ParameterBag
 {
+    public function __construct(array $parameters = array())
+    {    
+	$authorizationHeader = null;


indention wrong

stof · 2012-04-04T01:59:53Z

@fabpot could you review it ?

fabpot · 2012-04-04T07:15:34Z

My comments:

ServerBag represents what we have in the $_SERVER global variables. As such, the code should be moved to the getHeaders() method instead like the other tweaks we do for the HTTP headers.
A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs).
The code should only be executed when PHP_AUTH_USER is not available (to not have any overhead when not needed).

danielholmes · 2012-04-14T13:27:09Z

A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this:

<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.*)$ app.php [QSA,L]
</IfModule>

NOTE: No ,L in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening

towards · 2012-04-20T15:44:30Z

src/Symfony/Component/HttpFoundation/ServerBag.php

+            }
+
+            // Decode AUTHORIZATION header into PHP_AUTH_USER and PHP_AUTH_PW
+            if ($authorizationHeader) {


Sf standard would be to use null !== when testing $authorizationHeader

towards · 2012-04-20T16:12:49Z

@kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI

kepten · 2012-04-20T16:15:57Z

ok, so is my PR is useless or should I still fix problems?

towards · 2012-04-20T16:20:26Z

your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes

vicb · 2012-04-20T16:20:36Z

I have been working with @towards: your PR is useful, please implement his comments and squash your PR.

…fastCGI under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: symfony#1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L]

kepten · 2012-04-20T16:59:07Z

never squashed before, is it okay now? :)

stof · 2012-04-20T17:21:07Z

it is

vicb · 2012-05-20T19:57:51Z

@fabpot this should be ready to be merged

@fabpot

Commits ------- a450d00 [HttpFoundation] HTTP Basic authentication is broken with PHP as cgi/fastCGI under Apache Discussion ---------- [HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache Bug fix: yes Feature addition: no Backwards compatibility break: no Symfony2 tests pass: yes Fixes the following tickets: #1813 Todo: - In order to work, add this to the .htaccess: RewriteEngine on RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] --------------------------------------------------------------------------- by stof at 2012-03-10T17:34:26Z you should also add a unit test for this --------------------------------------------------------------------------- by kepten at 2012-03-11T15:34:04Z Thanks for the feedback, I committed the changes. --------------------------------------------------------------------------- by stof at 2012-04-04T01:59:53Z @fabpot could you review it ? --------------------------------------------------------------------------- by fabpot at 2012-04-04T07:15:34Z My comments: * `ServerBag` represents what we have in the `$_SERVER` global variables. As such, the code should be moved to the `getHeaders()` method instead like the other tweaks we do for the HTTP headers. * A comment must be added explaining why this is needed and the configuration the user must have to make it work (then remove the Github URLs). * The code should only be executed when `PHP_AUTH_USER` is not available (to not have any overhead when not needed). --------------------------------------------------------------------------- by danielholmes at 2012-04-14T13:27:09Z A quick note on that .htaccess/apache configuration required, if adding to the Symfony SE htaccess file, then it will need to look like this: ``` <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ app.php [QSA,L] </IfModule> ``` NOTE: No **,L** in the Authorization Rewrite as in the original example - it prevents the front controller rewrite from happening --------------------------------------------------------------------------- by towards at 2012-04-20T16:12:49Z @kepten you were faster than me applying @fabpot's comments :) nevertheless part of the bug hunt day I also modified the ServerBag class and tested them on a productive LAMP hosting server using Apache and FastCGI --------------------------------------------------------------------------- by kepten at 2012-04-20T16:15:57Z ok, so is my PR is useless or should I still fix problems? --------------------------------------------------------------------------- by towards at 2012-04-20T16:20:26Z your PR is fine for sure and I don't want to interfere, just wanted to mention that part of the bug hunt day of Symfony I had a go at this PR as an "exercise" but just saw later on that you already fixed the problem, so you can ignore my pushes --------------------------------------------------------------------------- by vicb at 2012-04-20T16:20:36Z I have been working with @towards: your PR is useful, please implement his comments and squash your PR. --------------------------------------------------------------------------- by kepten at 2012-04-20T16:59:07Z never squashed before, is it okay now? :) --------------------------------------------------------------------------- by stof at 2012-04-20T17:21:07Z it is --------------------------------------------------------------------------- by vicb at 2012-05-20T19:57:51Z @fabpot this should be ready to be merged

stof reviewed Mar 10, 2012
View reviewed changes

Tobion reviewed Mar 11, 2012
View reviewed changes

vicb mentioned this pull request Apr 13, 2012

http basic authentication broken with PHP as cgi/fastCGI under Apache #1813

Closed

towards reviewed Apr 20, 2012
View reviewed changes

fabpot merged commit a450d00 into symfony:2.0 May 21, 2012

This was referenced Apr 20, 2013

[HTTPFoundation] Use apache_request_headers when available #7170

Closed

[HTTPFoundation] fixed stripped HTTP_AUTHORIZATION headers #7649

Closed

added a note about php-cgi and Apache symfony/symfony-docs#2529

Merged

wouterj mentioned this pull request Dec 22, 2021

[HttpFoundation] Fix notice when HTTP_PHP_AUTH_USER passed without pass #44759

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache #3551

[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache #3551

kepten commented Mar 10, 2012

stof Mar 10, 2012

immutef Mar 10, 2012

stof Mar 10, 2012

immutef Mar 10, 2012

stof commented Mar 10, 2012

kepten commented Mar 11, 2012

Tobion Mar 11, 2012

stof commented Apr 4, 2012

fabpot commented Apr 4, 2012

danielholmes commented Apr 14, 2012

towards Apr 20, 2012

towards commented Apr 20, 2012

kepten commented Apr 20, 2012

towards commented Apr 20, 2012

vicb commented Apr 20, 2012

kepten commented Apr 20, 2012

stof commented Apr 20, 2012

vicb commented May 20, 2012

[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache #3551

[HttpFoundation] HTTP Basic authentication is broken with php-cgi under Apache #3551

Conversation

kepten commented Mar 10, 2012

stof Mar 10, 2012

Choose a reason for hiding this comment

immutef Mar 10, 2012

Choose a reason for hiding this comment

stof Mar 10, 2012

Choose a reason for hiding this comment

immutef Mar 10, 2012

Choose a reason for hiding this comment

stof commented Mar 10, 2012

kepten commented Mar 11, 2012

Tobion Mar 11, 2012

Choose a reason for hiding this comment

stof commented Apr 4, 2012

fabpot commented Apr 4, 2012

danielholmes commented Apr 14, 2012

towards Apr 20, 2012

Choose a reason for hiding this comment

towards commented Apr 20, 2012

kepten commented Apr 20, 2012

towards commented Apr 20, 2012

vicb commented Apr 20, 2012

kepten commented Apr 20, 2012

stof commented Apr 20, 2012

vicb commented May 20, 2012