title: PHP Digest HTTP Authentication example not working, why?
body: <p>So I decided to use digest HTTP authentication for my REST API. I googled it and found an entry in the PHP manual with an example of how to do it. So I copy the script, put it in index.php on my server, open the page in the browser, after entering my credentials the browser asks for them again and I'm stuck in an infinite loop of entering credentials. The script is included below and can be found <a href="http://php.net/manual/en/features.http-auth.php" rel="noreferrer">here</a>.</p>
  
  <p><strong>Example #7 Digest HTTP Authentication example</strong></p>
  
  <pre><code>&lt;?php
  $realm = 'Restricted area';
  
  //user =&gt; password
  $users = array('admin' =&gt; 'mypass', 'guest' =&gt; 'guest');
  
  
  if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
      header('HTTP/1.1 401 Unauthorized');
      header('WWW-Authenticate: Digest realm="'.$realm.
             '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
  
      die('Text to send if user hits Cancel button');
  }
  
  
  // analyze the PHP_AUTH_DIGEST variable
  if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
      !isset($users[$data['username']]))
      die('Wrong Credentials!');
  
  
  // generate the valid response
  $A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
  $A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
  $valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);
  
  if ($data['response'] != $valid_response)
      die('Wrong Credentials!');
  
  // ok, valid username &amp; password
  echo 'Your are logged in as: ' . $data['username'];
  
  
  // function to parse the http auth header
  function http_digest_parse($txt)
  {
      // protect against missing data
      $needed_parts = array('nonce'=&gt;1, 'nc'=&gt;1, 'cnonce'=&gt;1, 'qop'=&gt;1, 'username'=&gt;1, 'uri'=&gt;1, 'response'=&gt;1);
      $data = array();
      $keys = implode('|', array_keys($needed_parts));
  
      preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER);
  
      foreach ($matches as $m) {
          $data[$m[1]] = $m[3] ? $m[3] : $m[4];
          unset($needed_parts[$m[1]]);
      }
  
      return $needed_parts ? false : $data;
  }
  ?&gt;
  </code></pre>
  
  <p>I also tried basic authentication and that worked perfectly.</p>
  
  <p><strong>Example #6 Basic HTTP Authentication example</strong></p>
  
  <pre><code>&lt;?php
  if (!isset($_SERVER['PHP_AUTH_USER'])) {
      header('WWW-Authenticate: Basic realm="My Realm"');
      header('HTTP/1.0 401 Unauthorized');
      echo 'Text to send if user hits Cancel button';
      exit;
  } else {
      echo "&lt;p&gt;Hello {$_SERVER['PHP_AUTH_USER']}.&lt;/p&gt;";
      echo "&lt;p&gt;You entered {$_SERVER['PHP_AUTH_PW']} as your password.&lt;/p&gt;";
  }
  ?&gt;
  </code></pre>
  
  <p>It seems like <code>$_SERVER['PHP_AUTH_DIGEST']</code> is always empty.</p>
  
  <p><strong>Is there something wrong with the script or is my environment funky and if so how do I fix it?</strong></p>
  
  <p><strong>EDIT:</strong> There is nothing wrong with the script. The fault lies with the server. If anyone knows what could possibly cause this, please let me know.</p>