Basic Auth is not passed through with PHP in CGI mode #1

Activity

1. rmccue

   added

   bug

   on Apr 29, 2014
2. vlood commented on Jan 25, 2015

   

   vlood

   on Jan 25, 2015

   More actions

   A workaround: https://wordpress.org/support/topic/authentication-hacks?replies=3
3. graham73may commented on Mar 21, 2016

   

   graham73may

   on Mar 21, 2016

   More actions

   Ran into this problem today, the solution we are using is to add:

       if (!isset($_SERVER['PHP_AUTH_USER']) && (isset($_SERVER['HTTP_AUTHORIZATION']) || isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']))) {
           if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
               $header = $_SERVER['HTTP_AUTHORIZATION'];
           } else {
               $header = $_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
           }
   
           list($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']) = explode(':', base64_decode(substr($header, 6)));
       }
   

   To basic-auth.php in at line 22 underneath:

       // Don't authenticate twice
       if (!empty($user)) {
           return $user;
       }
   

   We also added the following to the .htaccess (replacing the normal index.php rewrite rule):

   RewriteRule . /index.php [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
   
4. graham73may commented on Mar 21, 2016

   

   graham73may

   on Mar 21, 2016

   More actions

   Pull request created

   #32
5. mnelson4 commented on May 6, 2016

   

   mnelson4

   on May 6, 2016

   More actions

   ran into this same issue; specifically I needed to change my .htaccess file to

   # BEGIN WordPress
   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteBase /
   RewriteRule ^index\.php$ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule . /index.php [L]
   </IfModule>
   # END WordPress
   

   👍React with 👍4Reacted by Micah Wood, Myles, Gerald Kogler and ghost

   ❤️React with ❤️1Reacted by ghost
6. mnelson4 commented on May 9, 2016

   

   mnelson4

   on May 9, 2016

   More actions

   FYI we also created a branch https://github.com/eventespresso/Basic-Auth/tree/automatic-update-htaccess-for-fcgi which adds a setting onto the WP permalinks page which should automatically update the .htaccess file, but it's untested
7. Rococolab commented on Sep 29, 2020

   

   Rococolab

   on Sep 29, 2020

   More actions

   Hi
   any idea how to solve the same issue but on NGINX instead of APACHE
   Thanks