Process Request
- Code: Select all
client -> GET /
server -> set REMOTE_USER=user
set REDIRECT_REMOTE_USER=REMOTE_USER if 401 errordocument
show errordocument 401 if invalid user/pass
errordocument 401 requests user pass with "Authorization Required"
401 sends Header- 'WWW-Authenticate: Basic ream="AskApachePass"'
client -> GET /
send username and password with
Header- 'Authorization: Basic (base64_encoded username:password)'
server -> (repeats until authorized)
2 .htaccess tricks required
1. a custom 401 ErrorDocument specifying a php file (logger).
2. pass along the clients username using mod_rewrite.
- Code: Select all
.htaccess
ErrorDocument 401 /log-htpasswd.php
# BEGIN AskApache Password Protect
AuthName "AskApachePass"
AuthUserFile /.htpasswd
AuthGroupFile /dev/null
AuthType Basic
Require valid-user
# END AskApache Password Protect
RewriteEngine On
RewriteBase /
RewriteCond %{ENV:REDIRECT_STATUS} ^401$
RewriteRule .* - [E=REMOTE_USER:%{ENV:REDIRECT_REMOTE_USER}]
log-htpasswd.php
- Code: Select all
<?php
define('LOGINS_LOG','/home/user/log-htpasswd.log');
if(isset($_ENV['REDIRECT_REMOTE_USER']) && !empty($_ENV['REDIRECT_REMOTE_USER'])){
$fp = fopen(LOGINS_LOG, 'a ');
fwrite($fp, $_ENV['REDIRECT_REMOTE_USER']);
fclose($fp);
}
ob_start();
header("HTTP/1.1 401 Authorization Required",1);
header("Status: 401 Authorization Required",1);
echo '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head><title>401 Authorization Required</title></head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested. Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn\'t understand how to supply
the credentials required.</p>';
exit;
exit();
?>
example log-htpasswd.log
just a list of usernames attempted
username1
tom
rcowen
askapache
dreamhost
dreamadmin
All you need to do now is add mysql commands to log-htpasswd.php... And you should tighten the security for log-htpasswd.php to only allow from from server for redirects to secure against crackers and hackers. more .htaccess tricks