feat(authentication): adds HTTP basic auth

2026-06-28 02:56:36 +02:00
parent 18b2bd2756
commit 0a40162fde
2 changed files with 33 additions and 0 deletions
@@ -1,3 +1,7 @@
+# ── HTTP Basic Auth (uncomment to enable) ──
+# AUTH_USERNAME=admin
+# AUTH_PASSWORD=secret
+
 # ── PEM files (recommended for Let's Encrypt / certbot) ──
 CERT_FILE=fullchain6.pem
 PRIVKEY_FILE=privkey.pem
@@ -9,6 +9,35 @@ $dotenv->safeLoad();

 $basePath = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/');

+// ── HTTP Basic Auth ──
+$authUser = $_ENV['AUTH_USERNAME'] ?? '';
+$authPass = $_ENV['AUTH_PASSWORD'] ?? '';
+
+if ($authUser !== '' || $authPass !== '') {
+    if (!isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
+        $authHeader = $_SERVER['HTTP_AUTHORIZATION']
+            ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
+            ?? '';
+        if (preg_match('/Basic\s+(.+)/i', $authHeader, $m)) {
+            $decoded = base64_decode($m[1], true);
+            if ($decoded !== false && str_contains($decoded, ':')) {
+                [$_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']]
+                    = explode(':', $decoded, 2);
+            }
+        }
+    }
+
+    $valid = ($_SERVER['PHP_AUTH_USER'] ?? '') === $authUser
+           && ($_SERVER['PHP_AUTH_PW'] ?? '') === $authPass;
+
+    if (!$valid) {
+        header('WWW-Authenticate: Basic realm="DropSign"');
+        http_response_code(401);
+        echo json_encode(['error' => 'Authentication required']);
+        exit;
+    }
+}
+
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    ?><!DOCTYPE html>
 <html lang="en">