php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #74452 Add 'Form' to Supported AuthType Authentication Methods w/ HTTP authentication
Submitted: 2017-04-16 05:28 UTC Modified: 2017-04-30 04:22 UTC
From: greywood at keystreams dot net Assigned:
Status: No Feedback Package: Apache2 related
PHP Version: Irrelevant OS: N/A
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: greywood at keystreams dot net
New email:
PHP Version: OS:

 

 [2017-04-16 05:28 UTC] greywood at keystreams dot net 
Description:
------------
Currently, the AuthType methods supported by HTTP authentication with PHP (https://secure.php.net/manual/en/features.http-auth.php) are 'Basic' and 'Digest'.

Using the 'Form' AuthType supplied by Apache does not provide the PHP_AUTH_PW predefined variable as desired. Only PHP_AUTH_USER and REMOTE_USER are present.

Can PHP be made to support the 'Form' AuthType and provide the PHP_AUTH_PW predefined variable for it?

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-04-17 00:13 UTC] danack@php.net
-Status: Open +Status: Feedback
 [2017-04-17 00:13 UTC] danack@php.net 
Are you asking about https://httpd.apache.org/docs/2.4/mod/mod_auth_form.html 

Because if so, are you sure the password is meant to be passed to the underlying application? The manual implies pretty strongly that it wouldn't be except under unusual circumstances.

"Warning

A risk exists that under certain circumstances, the login form configured using inline login may be submitted more than once, revealing login credentials to the application running underneath. The administrator must ensure that the underlying application is properly secured to prevent abuse. If in doubt, use the standalone login configuration."
 [2017-04-30 04:22 UTC] php-bugs at lists dot php dot net 
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Mon Apr 29 15:01:31 2024 UTC