E
E
EVOSandru62018-02-27 12:22:38
Yii
EVOSandru6, 2018-02-27 12:22:38

Why can http authentication work incorrectly on the server for the soap service?

Good afternoon,
I completed the construction of the wsdl structure, everything is being worked out without authorization, I want to stick the simplest http authorization:

class SoapWebServiceAction extends CWebServiceAction
{
   public function run()
    {
        header('Content-Type: text/xml; charset=utf-8');

        $username = '123';
        $passwd = '123';

        header('X-HEADER : ' . $_SERVER['PHP_AUTH_USER'] . ':' .$_SERVER['PHP_AUTH_PW']);

        if (!isset($_SERVER['PHP_AUTH_USER'])) {
            header('WWW-Authenticate: Basic realm="My Realm"');
            header('HTTP/1.0 401 Unauthorized: ' . $_SERVER['PHP_AUTH_USER'] . ':' .$_SERVER['PHP_AUTH_PW']);
            echo "Вы должны ввести корректный логин и пароль для получения доступа к ресурсу";
            exit;
        } else {
             if ($username == $_SERVER['PHP_AUTH_USER'] && $passwd == $_SERVER['PHP_AUTH_PW']) {
                parent::run();
            }
            else {
                throw new Exception($_SERVER['PHP_AUTH_USER'] . ':' .$_SERVER['PHP_AUTH_PW']);
            }
        }
    }
...
}

1. I check through the soapui program . I enter the address of the service, I enter the access data, I get a list of methods with a template for the request.
2. For requests, also enter authorization data for each method. Made.
If I enter incorrect data - 99, 888, then I catch as expected:
99:888 from the block:
throw new Exception($_SERVER['PHP_AUTH_USER'] . ':' .$_SERVER['PHP_AUTH_PW']);

Everything is clear here, the authorization data is not correct, but if I enter the correct (123, 123) data, then I catch ('' - voids):
HTTP/1.0 401 '' : ''
As if I did not send authorization data.
Tell me - why can this be?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
I
ivankomolin, 2018-02-27
@ivankomolin

Instead of
Write
And see the result)
And by the way, be careful with such password checks "=="

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question