$_SERVER 变量被放置在我运行 CGI 的主机上
由于我的主机的设置（在 CGI 接口上运行），变量 $_SERVER['PHP_AUTH_USER'] 和 $_SERVER['PHP_AUTH_PW'] 返回为空。是否有任何解决方法可以让它们工作，因为我需要使用它们进行身份验证。我无法移动托管或更改界面。
我通过curl 将身份验证请求发送到url /api/projects/... 它由 modrewrite 解释，然后根据规则进行处理。
当我在运行 MAMP 的本地主机上尝试此操作时，或者我使用其他主机时，它工作正常（不使用 CGI 接口），但在我需要它运行的服务器上，变量被删除！
有人可以帮我吗？
The variables $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are returned as empty because of the setup my hosting has (Running on a CGI interface). Is there any work around to get them to work as I need to use them for auth. I can't move hosting or change the interface.
I am sending auth requests via curl to a url /api/projects/...
which is interpreted by a modrewrite and then processed according to the rules.
When I try this on my local host running MAMP, or I use my other hosting it works ok (not using CGI interface) but on the server I need it to run on, the variables are dropped!
Can some one help me please?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
根据手册，这些变量仅当 PHP 作为 Apache 模块运行时才可用。 http://php.net/manual/en/features.http-auth。 php
您可以尝试与您的托管提供商联系，看看他们是否可以在 CGI 分派请求时为您提供这些内容。
As per the manual, those variables are only available when PHP runs as an Apache module. http://php.net/manual/en/features.http-auth.php
You can try talking to your hosting provider and see if they can make them available to you when CGI dispatches the request.
根据 docs，这两个变量在CGI 模式。
但是，请深入研究用户贡献的注释。人们声称已经成功使用了许多解决方法，例如 这个。也许值得一看。
According to the docs, those two variables are not available in CGI mode.
however, take a delve into the User Contributed Notes. There is a number of workarounds people claim to have had success with, e.g. this one. Maybe worth checking out.
如果是用于自动化使用，则根本不需要使用 HTTP 身份验证。只需发送一个秘密令牌作为凭证即可。
if it's for automated usage, no need to use HTTP auth at all. just send a secret token as a credentials.
默认情况下，Apache Web 服务器会阻止 CGI 应用程序的
HTTP_AUTHORIZATION环境变量，PHP 使用该变量来填充PHP_AUTH_USER/PASS。可以通过设置 SECURITY_HOLE_PASS_AUTHORIZATION 标志重新编译 Apache 来关闭此行为。“安全漏洞”是共享服务器上的任何其他用户都能够看到通过您的站点进行身份验证的用户的密码。这是否实际上对您来说是一个安全漏洞取决于；通常不会。
如果您使用廉价的共享服务器，您很可能没有机会重新编译 Apache。
，如果您有
mod_rewrite可用，那么应该可以。 （关于它可能是一个“安全漏洞”的警告仍然适用。）然而，它很丑陋，并且使部署复杂化。给出的示例脚本也存在一些问题（使用
explode会丢弃密码中的任何:字符，并且echo不会正确使用htmlspecialchars()会引入 XSS 漏洞。）这种废话是 HTTP 身份验证越来越不受欢迎的原因之一。大多数站点都部署基于表单/cookie 的身份验证。对于 API，您通常会拥有自己的基于令牌的身份验证，而不是依赖基本身份验证。
The Apache web server blocks the
HTTP_AUTHORIZATIONenvironment variable for CGI apps by default, which is what PHP uses to populatePHP_AUTH_USER/PASS. This behaviour can be turned off by recompiling Apache with the SECURITY_HOLE_PASS_AUTHORIZATION flag set.The “security hole” is that any other users on a shared server will be able to see the passwords of users authenticating with your site. Whether that's actually a security hole for you depends; often not.
If you are on a cheapo shared server chances are you are not going to get the chance to recompile Apache.
Yes, it should do, if you have
mod_rewriteavailable. (The caveats about it being potentially a “security hole” still apply.)It is, however, ugly, and complicates deployment. Also there are a few problems with the example script given (the use of
explodediscards any:characters in the password, and theechos without proper use ofhtmlspecialchars()introduce an XSS vulnerability.)This kind of nonsense is one of the reasons HTTP Authentication is increasingly unpopular. Most sites deploy form/cookie-based auth instead. For an API you would typically have your own token-based auth instead of relying on Basic Authentication.
查看
https://github.com/symfony/symfony/issues/1813
了解对此进行讨论并提供详细的解决方法。
Check out
https://github.com/symfony/symfony/issues/1813
for a discussion of this and a detailed workaround.