diff --git a/.env.example b/.env.example index 42877c5..20bcb60 100644 --- a/.env.example +++ b/.env.example @@ -1,3 +1,7 @@ +# ── HTTP Basic Auth (uncomment to enable) ── +# AUTH_USERNAME=admin +# AUTH_PASSWORD=secret + # ── PEM files (recommended for Let's Encrypt / certbot) ── CERT_FILE=fullchain6.pem PRIVKEY_FILE=privkey.pem diff --git a/index.php b/index.php index d96e27e..a266f7f 100644 --- a/index.php +++ b/index.php @@ -9,6 +9,35 @@ $dotenv->safeLoad(); $basePath = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/'); +// ── HTTP Basic Auth ── +$authUser = $_ENV['AUTH_USERNAME'] ?? ''; +$authPass = $_ENV['AUTH_PASSWORD'] ?? ''; + +if ($authUser !== '' || $authPass !== '') { + if (!isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) { + $authHeader = $_SERVER['HTTP_AUTHORIZATION'] + ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] + ?? ''; + if (preg_match('/Basic\s+(.+)/i', $authHeader, $m)) { + $decoded = base64_decode($m[1], true); + if ($decoded !== false && str_contains($decoded, ':')) { + [$_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']] + = explode(':', $decoded, 2); + } + } + } + + $valid = ($_SERVER['PHP_AUTH_USER'] ?? '') === $authUser + && ($_SERVER['PHP_AUTH_PW'] ?? '') === $authPass; + + if (!$valid) { + header('WWW-Authenticate: Basic realm="DropSign"'); + http_response_code(401); + echo json_encode(['error' => 'Authentication required']); + exit; + } +} + if ($_SERVER['REQUEST_METHOD'] === 'GET') { ?>