1

TL;DR is there some way to set the REMOTE_USER variable when bypassing .htaccess login?

I have a login and authentication system running in php on my website. In order to control access to a subdirectory I would like to use http basic auth with .htaccess (I am somewhat limited in my options here because of what my shared hosting instance offers). This answer worked for me for allowing the visitor logged-in with php to avoid having to enter login information a second time in a basic auth dialog.

Bypass .htaccess login when user has a specific cookie SetEnvIf

But I am struggling with one issue now:

The above method works, but htaccess doesn't seem to know the visitor's username. In an ordinary htaccess login, htaccess would set the REMOTE_USER variable upon login.

Is there an alternative way I make htaccess retrieve the username of the php user and so set the REMOTE_USER variable (maybe using a second cookie)? I need this because after auth the visitor should pass through to a mediawiki site.

Here's another question that goes in the direction of what I am trying to solve:

How do I make a PHP variable accessible to .htaccess?

In the case described at the link above, answers suggest making a php variable accessible to htaccess is not possible, because the php and .htaccess are in the same directory. In my case, the .htaccess concerned is in a subdirectory to which the visitor navigates after the php log in. Is it then possible to have the REMOTE_USER set, e.g., on the basis of $_SERVER['REMOTE_USER'] that is set by php?

JedO
  • 133
  • 5
  • It's unclear what you mean with php username. By default it is www-data. Do you mean the logged in user name? – Markus Zeller Aug 01 '20 at 16:42
  • I know it is not what you are asking but you can create a password protected set of pages (for example all those in a subdirectory) without any access to your server other than being able to put PHP files onto it. I followed the advice given here and I think it is secure and it is working well: https://stackoverflow.com/questions/4115719/easy-way-to-password-protect-php-page You could encrypt the password with bcrypt if you are not happy storing the actual password. This approach is OK if just a few people need to access the site. You just tell them the password. – user3425506 Aug 01 '20 at 22:10
  • 1
    You might, but if you do *anything* important with `REMOTE_USER`, keep in mind that users can change their cookies and it will be easy to impersonate someone else. – Evert Aug 02 '20 at 02:23

0 Answers0