-1

我编写了一个类来使用 HTTP Authentication the Digest 方式对用户进行身份验证。我读了几篇文章，我得到了它的工作。现在，我想让它使用 Md5 密码，但我似乎无法让它工作，这是验证用户的功能。

public function authenticate() {

// In case the user is not logged in already.
if (empty($_SERVER['PHP_AUTH_DIGEST'])) {

    // Return the headers.
    $this->show_auth();

} else {

    // Parse the given Digest-data.
    $data = $this->parse_request($_SERVER['PHP_AUTH_DIGEST']);

    // Check the data.
    if (!$data) { 

        // Display an error message.
        die($this->unauthorized);

    } else {

        // Based on the given information, generate the valid response.
        $usr_password = "test";

        // Generate the response partly.
        $A1 = md5($data['username'].":".$this->get_realm().":".$usr_password);
        $A2 = md5($_SERVER['REQUEST_METHOD'].":".$data['uri']);

        // Generate the valid response.
        $val_response = md5($A1.":".$data['nonce'].":".$data['nc'].":".$data['cnonce'].":".$data['qop'].":".$A2);

        // Compare the valid response with the given response.
        if ($data['response'] != $val_response) {

            // Display the login again.
            $this->show_auth();

        } else {

            // Return true.
            return true;

        }

    }

}

}

所以想象 $usr_password="test" 将是 $usr_password=md5("test");

那我该如何比较密码呢？

谢谢。

4

1 回答 1

0

The MD5 function is hashing function, one-directional method to produce the same result for the same input.

Thus, to compare $password1 to $password2 without revealing (comparing directly) both of them it should be enough to compare their hashes:

$hash1 = md5($password1); // hash for pass 1
$hash2 = md5($password2); // hash for pass 2

if ($hash1 === $hash2) {
    // here goes the code to support case of passwords being identical
} else {
    // here goes the code to support case of passwords not being identical
}

Is it clear enough? Let me know.

于 2011-11-03T09:19:01.037 回答