I've done some tests today and here are my results.
First, I was mistaken yesterday, the browser sends a Authorization header, not WWW-Authenticate; the server sends the latter to notify the client that the directory is protected.
Then, when you go to user:pwd@site.com, the browser doesn't send directly the Authorization header (IE and NS behave like this). If the server returns a 401 status code, then the browser sends the login/password. So to retrieve them in PHP, do something like this :
$h=getallheaders();
if(!isset($h["Authorization"]))
{
//Force browser to send login/password
Header("HTTP/1.0 401 Not authorized");
Header("WWW-Authenticate: Basic realm=\"Test\"");
exit;
}
//Split Basic and encoded parts
$a=split(" ",$h["Authorization"]);
//Decode user/password
print base64_decode($a[1]);
Note : this will only work if both user and password are supplied. If not, the login popup will appear.
And now, the final question : what's the use of all this ?