Class BasicAuthenticate

Basic Authentication adapter for AuthComponent.

Provides Basic HTTP authentication support for AuthComponent. Basic Auth will authenticate users against the configured userModel and verify the username and passwords match.

Using Basic auth

In your controller's components array, add auth + the required settings.

public $components = array(
        'Auth' => array(
                'authenticate' => array('Basic')
        )
);

You should also set AuthComponent::$sessionKey = false; in your AppController's beforeFilter() to prevent CakePHP from sending a session cookie to the client.

Since HTTP Basic Authentication is stateless you don't need a login() action in your controller. The user credentials will be checked on each request. If valid credentials are not provided, required authentication headers will be sent by this authentication provider which triggers the login dialog in the browser/client.

You may also want to use $this->Auth->unauthorizedRedirect = false;. By default, unauthorized users are redirected to the referrer URL, AuthComponent::$loginAction, or '/'. If unauthorizedRedirect is set to false, a ForbiddenException exception is thrown instead of redirecting.

BaseAuthenticate implements CakeEventListener

BasicAuthenticate

Direct known subclasses

DigestAuthenticate

Package: Cake\Controller\Component\Auth
Copyright: Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
License: MIT License
Since: 2.0
Located at Cake/Controller/Component/Auth/BasicAuthenticate.php

Method Detail

__constructsource public

__construct( ComponentCollection $collection , array $settings )

Constructor, completes configuration for basic authentication.

Parameters

ComponentCollection $collection: The Component collection used on this request.
array $settings: An array of settings.

Overrides

BaseAuthenticate::__construct()

authenticatesource public

authenticate( CakeRequest $request , CakeResponse $response )

Authenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.

Parameters

CakeRequest $request: The request to authenticate with.
CakeResponse $response: The response to add headers to.

Returns

mixed
Either false on failure, or an array of user data on success.

getUsersource public

getUser( CakeRequest $request )

Get a user based on information in the request. Used by cookie-less auth for stateless clients.

Parameters

CakeRequest $request: Request object.

Returns

mixed
Either false or an array of user information

Overrides

BaseAuthenticate::getUser()

loginHeaderssource public

loginHeaders( )

Generate the login headers

Returns

string
Headers for logging in.

unauthenticatedsource public

unauthenticated( CakeRequest $request , CakeResponse $response )

Handles an unauthenticated access attempt by sending appropriate login headers

Parameters

CakeRequest $request: A request object.
CakeResponse $response: A response object.

Throws

UnauthorizedException
UnauthorizedException

Overrides

BaseAuthenticate::unauthenticated()

Methods inherited from BaseAuthenticate

_findUsersource protected

_findUser( string|array $username , string $password null )

Find a user record using the standard options.

The $username parameter can be a (string)username or an array containing conditions for Model::find('first'). If the $password param is not provided the password field will be present in returned array.

Input passwords will be hashed even when a user doesn't exist. This helps mitigate timing attacks that are attempting to find valid usernames.

Parameters

string|array $username: The username/identifier, or an array of find conditions.
string $password optional null: The password, only used if $username param is string.

Returns

boolean|array
Either false on failure, or an array of user data.

_passwordsource protected

_password( string $password )

Hash the plain text password so that it matches the hashed/encrypted password in the datasource.

Deprecated

3.0.0 Since 2.4. Use a PasswordHasher class instead.

Parameters

string $password: The plain text password.

Returns

string
The hashed form of the password.

implementedEventssource public

implementedEvents( )

Implemented events

Returns

array
of events => callbacks.

Implementation of

CakeEventListener::implementedEvents()

logoutsource public

logout( array $user )

Allows you to hook into AuthComponent::logout(), and implement specialized logout behavior.

All attached authentication objects will have this method called when a user logs out.

Parameters

array $user: The user about to be logged out.

passwordHashersource public

passwordHasher( )

Return password hasher object

Returns

AbstractPasswordHasher
Password hasher instance

Throws

CakeException
If password hasher class not found or it does not extend AbstractPasswordHasher

Properties inherited from BaseAuthenticate

$_Collectionsource

protected ComponentCollection

A Component collection, used to get more components.

$_passwordHashersource

protected AbstractPasswordHasher

Password hasher instance.

$settingssource

public array

Settings for this object.

fields The fields to use to identify a user by.
userModel The model name of the User, defaults to User.
userFields Array of fields to retrieve from User model, null to retrieve all. Defaults to null.
scope Additional conditions to use when looking up and authenticating users, i.e. array('User.is_active' => 1).
recursive The value of the recursive key passed to find(). Defaults to 0.
contain Extra models to contain and store in session.
passwordHasher Password hasher class. Can be a string specifying class name or an array containing className key, any other keys will be passed as settings to the class. Defaults to 'Simple'.

array(
    'fields' => array(
        'username' => 'username',
        'password' => 'password'
    ),
    'userModel' => 'User',
    'userFields' => null,
    'scope' => array(),
    'recursive' => 0,
    'contain' => null,
    'passwordHasher' => 'Simple'
)

© 2005–2016 The Cake Software Foundation, Inc.
Licensed under the MIT License.
CakePHP is a registered trademark of Cake Software Foundation, Inc.
We are not endorsed by or affiliated with CakePHP.
http://api.cakephp.org/2.7/class-BasicAuthenticate.html