[RESOLVED] HTTP Authorization issues

ferrins

Hi everybody!!
Well, first thing's first I have to say hello to all people here since this is my first post, I've been getting into php during the last couple months, so I bet that I'll learn something from you all for sure. So, I just designed a very simple script trying to implement this HTTP authorization thing into my admin folder. And it works but with a very annoying problem, it pops up three times the login window and I can't figure out why. I've tried to do the same thing with an external function but keeps popping up 3 times the login window.
So, let me show you this simple piece of code and probably all you can help me out. Thanks!!

if (!isset($SESSION['id_admin'])) {
header('WWW-Authenticate: Basic realm="admin"');
header('HTTP/1_0 401 Unauthorized');
$nick=$SERVER['PHP_AUTH_USER'];
$passwd=$SERVER['PHP_AUTH_PW'];
$sql ="SELECT nick,passwd,id_admin FROM admin WHERE nick='$nick' AND passwd='$passwd'";
$res=mysql_query($sql,$conn) or die();
$row =mysql_fetch_array($res);
if($row['nick']==$nick && $row['passwd']==$passwd){
session_start();
$SESSION['id_admin']=$row['id_admin'];
echo "<script>document.location.href='../admin/index.php'</script>";
}else{
echo "Unauthorized\n";
}
exit();
}

Are you still here? Well, thank you!

bogu

This is how your script should look like:

<?php
	session_start(); 
	if (!isset($_SERVER['PHP_AUTH_USER'])) {
		header('WWW-Authenticate: Basic realm="admin"'); 
		header('HTTP/1_0 401 Unauthorized'); 
	    echo 'Text to send if user hits Cancel button'; 
	    exit; 
	} else {
		$nick = $_SERVER['PHP_AUTH_USER']; 
		$passwd = $_SERVER['PHP_AUTH_PW']; 

	$sql = "SELECT nick,passwd,id_admin FROM admin WHERE nick='$nick' AND passwd='$passwd'"; 
	$res = mysql_query($sql) or die(mysql_error()); 
	$row = mysql_fetch_array($res); 
	if( $row['nick']==$nick && $row['passwd']==$passwd ){ 
		$_SESSION['id_admin']=$row['id_admin'];
		/* redirect if the username and pass are correct */
		$redirect = "admin/index.php";
		header("Location: {$redirect}");
		die("If the page doesn't redirect click <a href='{$redirect}'>here</a>");
	}else{ 
	    echo 'Text to send if user entered incorect username or password!'; 
	    exit; 
	} 
}
?>

ferrins

Thankx!! it works great!

ferrins

Sorry, me again. Any idea on how to log out once you have log in with the HTTP Auth? I've been trying to unset like this:

unset($SERVER['PHP_AUTH_USER']);
unset($SERVER['PHP_AUTH_PW']);

it ain't working, any clue?

THANKX!!

bogu

Just send him back to authentication part:

header('WWW-Authenticate: Basic realm="admin"'); 
header('HTTP/1_0 401 Unauthorized'); 
echo 'Text to send if user hits Cancel button'; 
exit;