PHP CURL With HTTP Basic Authentication – A Simple Example

Welcome to a tutorial on how to do a PHP CURL call with HTTP basic authentication. Need to secure a server-to-server call without all the crazy encryption, verification, and login stuff? HTTP basic authentication is a good option.

That should cover the basics, but read on for an actual example.

ⓘ I have included a zip file with all the source code at the start of this tutorial, so you don’t have to copy-paste everything… Or if you just want to dive straight in.

 

 

REAL QUICK TUTORIAL

 

TABLE OF CONTENTS

Download & Notes	CURL With AUTH	Useful Bits & Links
The End

 

 

EXAMPLE CODE DOWNLOAD

Click here to download all the example source code, I have released it under the MIT license, so feel free to build on top of it or use it in your own project.

 

QUICK NOTES

1. This example is based on a XAMPP server.
2. Edit protected/.htaccess, change AuthUserFile to your own file path – The default user and password in protected/.htpasswd is USER and PASS.
3. Edit CURL-auth.php, change $url to your own.

If you spot a bug, please feel free to comment below. I try to answer questions too, but it is one person versus the entire world… If you need answers urgently, please check out my list of websites to get help with programming.

 

 

 

SERVER A) PHP CURL CALL

<?php
// (A) THE SETTINGS
$url = "http://localhost/protected/secret.php";
$user = "USER";
$password = "PASS";

// (B) CURL INIT
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, "$user:$password");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

// (C) CURL RUN
// (C1) GO!
$result = curl_exec($ch);

// (C2) CURL ERROR
if (curl_errno($ch)) {
  echo "CURL ERROR - " . curl_error($ch);
}

// (C3) CURL OK - FETCH RESULT
// NOTE: HTTP RESPONSE CODE 200 = OK
else {
  $info = curl_getinfo($ch);
  if ($info['http_code'] != 200) {
    print_r($info);
  } else {
    echo $result;
  }
}

// (C4) DONE
curl_close($ch);

This should be pretty self-explanatory.

• As in the introduction, all we need is to set CURL options (CURLOPT_HTTPAUTH and CURLOPT_USERPWD) accordingly.
• If you are having trouble with SSL (https://), try disabling the peer verification – CURLOPT_SSL_VERIFYPEER.
• Take note of the “fetch results” part, we can use curl_getinfo() to get more information on the server response. Importantly, check the http_code – A failed authentication will usually return 401 (unauthorized).

 

 

SERVER B) PROTECTED FOLDER

This is a small extra for you guys who are running Apache, and not know how to secure folders with basic HTTP auth.

1. Apache web servers come with a tool called htpasswd and we can use it to generate a user/password file –  htpasswd -c "PATH/FOLDER/.htpasswd" USER.
2. Next, create a .htaccess file in the folder that you want to protect.
   • AuthType Basic
   • AuthName "Password Required"
   • AuthUserFile PATH/FOLDER/.htpasswd
   • Require valid-user

That’s all.

 

 

 

INFOGRAPHIC CHEAT SHEET

 

LINKS & REFERENCES

• CURL Options – PHP
• Basic Authentication and Authorization – Apache
• htpasswd – Manage user files for basic authentication
• Basic Authentication For IIS – Microsoft
• Basic Authentication For NGINX