Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to authenticate for POST requests for http://path/to/logical/abc.xml (but not GET requests to that URL).

How do I put constraints like this in place? The paths are logical and location directive is not supported in .htaccess.

share|improve this question
    
use server side language –  Peter Feb 11 at 5:17
    
what do you mean by authenticate? ask for user and password or let the request pass? –  PatomaS Feb 14 at 2:44
add comment

3 Answers

If what you want is to let the request pass and be processed, by anything on the server, like perl, PHP, etc, you can something like this:

RewriteCond %{REQUEST_METHOD} !^(HEAD|POST)
RewriteRule .* - [F]

That way you allow POST and HEAD request but block all the rest

share|improve this answer
add comment

I guess something like this should work. I haven't tested it though.

<Limit POST>
Require valid-user
</Limit>
share|improve this answer
add comment

This can be accomplished using a PHP server-side script as follows (you may wish to customise/improve the user credentials storage and authentication mechanism somewhat!):

<?php
$sRealmName = 'Restricted Area';
$aUsers = array( 'admin' => 'admin', 'guest' => 'guest' );
if( $_SERVER['REQUEST_METHOD'] == 'POST' ) { 

    if( empty( $_SERVER['PHP_AUTH_DIGEST'] )) {
        header( 'HTTP/1.1 401 Unauthorized' );
        header( 'WWW-Authenticate: Digest realm="' . $sRealmName
        . '",qop="auth",nonce="' . uniqid() . '",opaque="'
        . md5( $sRealmName ).'"' );
        die( '401 Unauthorized: Login Required' );
    }

    $aParameters = array( 'nonce' => 1, 'nc' => 1, 'cnonce' => 1,
        'qop' => 1, 'username' => 1, 'uri' => 1, 'response' => 1 );
    $sKeys = implode( '|', array_keys( $aParameters ));
    preg_match_all( '@(' . $sKeys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', 
        $_SERVER['PHP_AUTH_DIGEST'], $aMatches, PREG_SET_ORDER );
    $aHttpAuthData = array();
    foreach( $aMatches as $aMatch ) {
        $aHttpAuthData[$aMatch[1]] = $aMatch[3] ? $aMatch[3] : $aMatch[4];
        unset( $aParameters[$aMatch[1]] );
    }

    $aData = $aParameters ? false : $aHttpAuthData;
    if( !$aData || !isset( $aUsers[$aData['username']] )) {
        header( 'HTTP/1.1 401 Unauthorized' );
        header( 'WWW-Authenticate: Digest realm="' . $sRealmName 
        . '",qop="auth",nonce="' . uniqid() . '",opaque="' 
        . md5( $sRealmName ).'"' );
        die( '401 Unauthorized: Login Incorrect' );
    }

    $sMd5User = md5( $aData['username'] . ':' . $sRealmName . ':' .
    $aUsers[$aData['username']]);
    $sMd5Request = md5( $_SERVER['REQUEST_METHOD'] . ':' . $aData['uri'] );
    $sMd5Digest = md5( $sMd5User . ':' . $aData['nonce'] . ':'
    . $aData['nc'] . ':' . $aData['cnonce']. ':' .$aData['qop'] . ':'
    . $sMd5Request );

    if( $aData['response'] != $sMd5Digest ) {
        header( 'HTTP/1.1 401 Unauthorized' );
        header( 'WWW-Authenticate: Digest realm="' . $sRealmName
        . '",qop="auth",nonce="' . uniqid() . '",opaque="' 
        . md5( $sRealmName ) . '"' );
        die( '401 Unauthorized: Login Incorrect' );
    }  
}

header( "Expires: Mon, 26 Jul 1997 05:00:00 GMT" );
header( "Last-Modified: " . gmdate( "D, d M Y H:i:s" ) . " GMT" );
header( "Cache-Control: no-store, no-cache, must-revalidate" );
header( "Cache-Control: post-check=0, pre-check=0", false );
header( "Pragma: no-cache" ); 
header( "Content-type: application/xml" );
echo( '<?xml version="1.0" encoding="UTF-8"?>' . "\r\n" );
echo( '<envelope attribute="value">' . "\r\n" );
echo( '<node attribute="value"></node>' . "\r\n" );
echo( '</envelope>' . "\r\n" );
share|improve this answer
    
I edited your post. Take a look at the codeblock. Here you see every line of code is starting with at least 4 spaces. That's the way to make it a code-block. If you paste it from a sourcefile, select everything you've pasted in, and click on the curlybrackets-symbol in the toolbar, just above the editfield, and every selected line will be indented with 4 spaces. read also: webmasters.stackexchange.com/editing-help –  ExploWare Mar 16 at 5:19
    
Thank you ExploWare, I've since been using this method or more recent posts but hadn't gone back through historic ones updating formatting (I might do this now). It's a shame there doesn't seem to be colour-coded syntax highlighting available as this can really improve readability greatly. –  richhallstoke Mar 17 at 10:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.