PHP MySQL - Stilson.net

www.it-ebooks.infoC H A P T E R 14• • •Authenticating Your UsersAuthenticating user identities is common practice not only for security-related reasons, but also to offercustomizable features based on user preferences and type. Typically, users are prompted for a usernameand password, the combination of which forms a unique identifying value for that user. In this chapter,you’ll learn how to prompt for and validate this information using a variety of methods, including asimple approach involving Apache’s htpasswd feature and approaches involving comparing theprovided username and password to values stored directly within the script, within a file, and within adatabase. In addition, you’ll learn how to use the Auth_HTTP PEAR package, test password strengthusing the CrackLib extension, and recover lost passwords using a concept known as a one-time URL. Insummary, the chapter concepts include:• Basic HTTP-based authentication concepts• PHP’s authentication variables, namely $_SERVER['PHP_AUTH_USER'] and$_SERVER['PHP_AUTH_PW']• Several PHP functions that are commonly used to implement authenticationprocedures• Three commonplace authentication methodologies: hard-coding the login pair(username and password) directly into the script, file-based authentication, anddatabase-based authentication• Taking advantage of the Auth_HTTP package• Testing password guessability using the CrackLib extension• Recovering lost passwords using one-time URLsHTTP Authentication ConceptsThe HTTP protocol offers a fairly effective means for user authentication, with a typical authenticationscenario proceeding like this:1. The client requests a restricted resource.2. The server responds to this request with a 401 (Unauthorized access) responsemessage.3. The browser recognizes the 401 response and produces a pop-upauthentication prompt similar to the one shown in Figure 14-1. All modernbrowsers are capable of understanding HTTP authentication and offering303