PHP身份验证对话框不断重复

Question

I'm using PHP and want to authenticate a user against an entry in a MySQL database. All pages use HTTPS.

The problem is when I enter the correct username and password, the authorize dialog box disappears then reappears with the username and password blank.

Does anybody know how to fix it?

Snippets of code:

<?php
  session_start();
  if($_SERVER["HTTPS"] != "on")
  {
     header("Location: https://" . $_SERVER["HTTP_HOST"] . $_SERVER     ["REQUEST_URI"]);
     exit();
  }

require_once("../php-files/cookies.php");
require_once("../php-files/db_connect.php");

/* If user tries to bypass logging in then we need to redirect back
 * to main page. First though, we need to get whether we're localhost or
 * live production.
 */

if($_SESSION["atHome"] == true)
{
  require_once("/Calendar/Month.php");
  require_once("/Calendar/Month/Weekdays.php");
}
else
{
  require_once("../Calendar/Month.php");
  require_once("../Calendar/Month/Weekdays.php");
}

include("../php-files/create-calendar.php");
include("../php-files/put-footer.php");
include("../php-files/timestamp.php");

//if cookie not set redirect back to home page
// prevents people from getting this page by using /php-files/new_event.php
// unless they have a cookie set

if(!isset($_COOKIE['www_broken_com']))
  {
    if($_SESSION["atHome"] == true)
      header("Location: https://localhost");
    else
      header("Location: https://www.broken.com");
  }

$theCookie = $_COOKIE['www_broken_com'];
$theCookie = explode(";",$theCookie); 

//check to see if an Admin is going to enter a new event
//if so ask if they want to enter or to approve events submitted
function authenticate_user()
{
    header('WWW-Authenticate: Basic Realm="New"');    
    header("HTTP/1.0 401 Unauthorized");
    return(FALSE);
}

$authenticate = TRUE;
$authorized = FALSE;
$authorizedName = "";
$privleges = "";
//Compare the email address of the person currently accessing and see if
//he's in the admin database. If so then he as admin privleges.
$db_conn = new db_stuff();
$db = $db_conn->connect();
$query = "SELECT * FROM admin WHERE email = '$theCookie[5]'";
if(!$result = $db->query($query)) exit("Could not select for new event");
if($result && $result->num_rows != 0)
{
    if(!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW']))
     $authenticate = authenticate_user();

    if($authenticate == TRUE)
    {

       $userName = $_SERVER['PHP_AUTH_USER'];
       $userPwd = $_SERVER['PHP_AUTH_PW'];    
       $query = "SELECT * FROM admin WHERE name = '$userName' AND pwd = PASSWORD('$userPwd')";
       if(!$result = $db->query($query)) 
         echo "<br />Could not select for authentication";
       if($result && $result->num_rows != 0)
       {
         while($admin = $result->fetch_array())
         {
           $authorizedName = $admin[2] . " " . $admin[1];
       }

      $authorized = TRUE;
      $privleges = ", you have administrator privleges.";
      $_SESSION['authorizedName'] = $authorizedName;
    }
}
else
{
        exit("In FALSE");  
  $authorized = FALSE;
  $_SERVER['PHP_AUTH_USER'] = "No one";
}
}
else
    $privleges = " ";

Answer 1

After much digging......

1. run phpinfo() to see if: Server API = CGI/FastCGI (It should be the 4th line from the top)
2. If it is set, you can't do basic-authorization without a work-around.
3. Common workaround is to alter htaccess and add this line: RewriteRule .*-[E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

This worked for me.

See stackoverflow: Basic Authentication with PHP gives an endless loop for more info.