Http.php

Go to the documentation of this file.

<?php

namespace Rsi\Fred\User\Authenticator;

class Http extends \Rsi\Fred\User\Authenticator{

  const EVENT_PASSWORD = 'user:authenticator:http:password';

  public $realm = 'FRED™';

  public function check(){
    if(!$this->controllerName){
      if(
        ($data = $this->digest()) &&
        $this->verify($data,$this->component('event')->trigger(self::EVENT_PASSWORD,$this,$data['username']))
      ) return true;
      $this->prompt();
      $this->_fred->halt();
    }
    return null;
  }

  public function invalidate(){
    if($this->checked && !headers_sent()) http_response_code(401); //Unauthorized
    parent::invalidate();
  }
  /**
   * Send headers for the digest prompt.
   */
  public function prompt(){
    http_response_code(401); //Unauthorized
    header('WWW-Authenticate: Digest realm="' . $this->realm . '",qop="auth",nonce="' . uniqid() . '",opaque="' . $this->hash([$this->realm]) . '"');
  }
  /**
   * Retrieve data from authentication digest.
   * @return array  Empty when digest not present not, false when incomplete.
   */
  public function digest(){
    $data = [];
    if(array_key_exists('PHP_AUTH_DIGEST',$_SERVER)) foreach(['nonce','nc','cnonce','qop','username','uri','response'] as $key)
      if(preg_match('/' . $key . '=(?:([\'"])([^\\1]+?)\\1|([^\\s,]+))/',$_SERVER['PHP_AUTH_DIGEST'],$match)) $data[$key] = $match[2] ?: $match[3];
      else return false;
    return $data;
  }

  protected function hash($data){
    return md5(implode(':',$data));
  }
  /**
   * Verify a password.
   * @param array $data  Data from digest().
   * @param string $password  Correct password for $data['username'].
   * @return bool  True when correct.
   */
  public function verify($data,$password){
    $this->verified(($data['response'] == $this->hash([
      $this->hash([$data['username'],$this->realm,$password]),
      $data['nonce'],$data['nc'],$data['cnonce'],$data['qop'],
      $this->hash([$_SERVER['REQUEST_METHOD'],$data['uri']])
    ])) ?: null);
    if(!$this->checked && !headers_sent()) http_response_code(401); //Unauthorized
    return $this->checked;
  }

}