您的位置: 首页  >  技术问答  >  如何在不需要身份验证时从URL检索尝试的$ _SERVER ['REMOTE_USER']

如何在不需要身份验证时从URL检索尝试的$ _SERVER ['REMOTE_USER']

分类: 技术问答 • 2022-03-09 20:07:14
问题描述：

Normally when a publicly-accessible directory requires basic HTTP authentication, the value of $_SERVER['HTTP_AUTHORIZATION'] and/or $_SERVER['REMOTE_USER'] (or $_SERVER['PHP_AUTH_USER'], etc) will be set and accessible to PHP once a valid username/password combination have been provided to the server.

For example, if http://www.example.com/members requires basic authentication, and a user successfully authenticates using the credentials myusername and mypassword by manually typing http://myusername:mypassword@www.example.com/members into their browser, the value of $_SERVER['HTTP_AUTHORIZATION'] would be something like:

Basic bXl1c2VybmFtZTpteXBhc3N3b3Jk

... and the value of $_SERVER['REMOTE_USER'] would simply be:

myusername

However if authentication is not required in the same directory, but the URL is still visited with the username/password inside of it, the values of the username/password don't seem to be set anywhere (running PHP 5.3.10 as CGI/FastCGI on Apache/2.2.22).

From within PHP (and/or .htaccess if necessary), when no authentication is required, is there a way to retrieve the values of the username (and/or password) that have been provided by a visitor who manually added them to the URL?

通常，当公共可访问目录需要基本HTTP身份验证时， $ _ SERVER ['HTTP_AUTHORIZATION'的值 ] code>和/或 $ _ SERVER ['REMOTE_USER'] code>（或 $ _ SERVER ['PHP_AUTH_USER'] code>等）将被设置并可供PHP访问 已向服务器提供有效的用户名/密码组合。 p>

例如，如果 http://www.example.com/members code>需要基本身份验证，并且 用户通过手动键入 http：// myusername：mypassword@www.example.com/members code>，使用凭据 myusername code>和 mypassword code>成功进行身份验证 他们的浏览器， $ _ SERVER ['HTTP_AUTHORIZATION'] code>的值类似于： p> 

  Basic bXl1c2VybmFtZTpteXBhc3N3b3Jk 
  code>  pre  > 
 
 
 ...  $ _ SERVER ['REMOTE_USER']  code>的值只是： p> 
 
 
  myusername 
  代码>  PRE> 
 
 
然而 如果在同一目录中不需要身份验证，但仍然使用其中的用户名/密码访问URL，则用户名/密码的值似乎不会在任何地方设置（将PHP 5.3.10作为CGI / FastCGI运行 在Apache / 2.2.22上。 p> 
 
 


 从PHP内部（和/或 .htaccess  code>，如有必要），，当不需要身份验证时  em>，有没有办法检索手动将其添加到网址的访问者提供的用户名（和/或密码）的值？ strong>  p> 
  div  >

答

TLDR; As far as I can see that information is never sent to server so I claim it's not possible.

The way http authentication works if you have it set is that server sends a request for user/pass if it's not already set, and browser then adds that information in encoded form to a Authorization header and sends it to the server along with the request.

As specified in RFC 2617, describing Basic and Digest authentication mechanisms For basic authentication, server sends HTTP 401 Not Authorized status and WWW-Authenticate header fields to request this information. (RFC 2617, Access Authentication Framework)

With tests one can see that if authentication is never configured on the server to be required, server won't request authentication information from browser, and browser won't add user/pass information into the request. RFC does not mandate browser (user agent) to not pass that information, but says instead

A user agent that wishes to authenticate itself with an origin server--usually, but not necessarily, after receiving a 401 (Unauthorized)--MAY do so by including an Authorization header field with the request.

In practice, if you watch the sent headers you can see that if this information is requested by the server, it's sent in encoded form using Authorization header like specified by the RFC. However, if you're not using any authentication the request you send just doesn't seem to contain that information in any form. I've confirmed this with IE, Firefox and Chrome browsers myself.

If you want to test this yourself for your setup, this can be done for example using netcat like this:

First, run netcat on your server:

nc -l 8888

Then issue a request from your browser to http://testvalue:testvalue@yourdomain:8888/

As a result, observe from netcat output all the information that get sent to server, something like this:

GET / HTTP/1.1
Host: yourdomain:8888
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

There is no information about user or password anywhere. I claim that unless the server requests it, it won't be there.

答

The addition of user and password in a url using http(s)://user:pass@site.com has been disabled by at least Internet Explorer for several years now, as far as i know.

https://support.microsoft.com/en-us/kb/834489

So I am not sure if what you are trying to reach is even usefull. I think the browsers dont even pass that part of the url on anymore.

相关推荐