public function executeSecure()
  {
    if (!$this->getUser()->hasAttribute("secure_referer"))
        $this->getUser()->setAttribute("secure_referer", $this->getRequest()->getReferer());
 
    if (!isset($_SERVER['PHP_AUTH_USER']))
    {
      header('WWW-Authenticate: Basic realm="Member Area"');
      header('HTTP/1.0 401 Unauthorized');
 
      return sfView::NONE;
    }
    else
    {   
        if ($this->getUser()->tryLogin($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']))
        {
            return $this->redirect($this->getUser()->getAttribute("secure_referer"));
        }
        else
        {
          header('WWW-Authenticate: Basic realm="Member Area"');
          header('HTTP/1.0 401 Unauthorized');
 
          return sfView::NONE;
        }
    }
  }

Comments on this snippet

#1 Olivier Verdier on 2006-05-28 at 10:52

One should never forget the DRY principle. Beside you should take advantage of the symfony methods. Here is a better version of that snippet:

public function executeSecure()
  {
    if (!$this->getUser()->hasAttribute("secure_referer"))
        $this->getUser()->setAttribute("secure_referer", $this->getRequest()->getReferer());
 
    echo $this->getUser()->getAttribute('secure_referer');
 
    if (isset($_SERVER['PHP_AUTH_USER']))
    {
        if ($this->getUser()->tryLogin($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']))
        {
           $this->redirect($this->getUser()->getAttribute("secure_referer"));
        }
    }
 
        $this->getResponse()->setHttpHeader('WWW-Authenticate',  'Basic realm="Member Area"');
        $this->getResponse()->setStatusCode('401');
        $this->sendHttpHeaders();
        return sfView::NONE;
  }

#2 Romain Dorgueil on 2006-05-31 at 10:52

Yeah thanks, you can erase the echo line too, it was only for debugging purposes :p

#3 scott meves on 2006-06-02 at 08:09

My browser goes into a redirect loop when using this. When I type in the URL for a secure page directly and login through HTTP_AUTH, because $_SERVER['PHP_AUTH_USER']) is set, it redirects me to the referring page. The referring page is secure, so symfony routes the request through the secure module again, and because $_SERVER['PHP_AUTH_USER']) is still set, it redirects me to the referring page again, and so on. Any suggestions?

#4 scott meves on 2006-06-05 at 03:14

In my version of symfony this line doesn't work:

$this->sendHttpHeaders();

Instead I have to do this:

$this->getResponse()->sendHttpHeaders();

#5 Olivier Verdier on 2006-06-10 at 12:06

I don't think that $this->sendHttpHeaders() has ever been possible in any version. ;-) Just one more mistake of mine. Thanks Scott.

(unfortunately i can't seem to be able to edit my own comments... :-( )

#6 Giorgio Cefaro on 2006-06-13 at 05:27

This could be comfortable, but I have a big doubt: What about logout? I think it cannot be safely implemented cause it's not fully server guaranteed. If the browser keeps in its cache PHP_AUTH_USER and PHP_AUTH_PW, even after logout someone can still navigate back with the browser having it automagically feed cached AUTH parameters with correct data!

#7 Giorgio Cefaro on 2006-06-13 at 05:29

please read: [..] with the browser having it automagically feed AUTH parameters with correct cache data!