What would be the advantages of using PHP_AUTH_USER and PHP_AUTH_PW instead of the verifying the credentials under method - post .

Why i should use: $_SERVER["PHP_AUTH_USER"]; and $_SERVER["PHP_AUTH_PW"]

instead of

$_POST["user"]; and $_POST["pass"];

what actual difference does it make ?
what are the advantages and disadvantages of both techniques ?
which one is more vulnerable ?


You want to know the advantages, so here goes: PHP_AUTH_USER is an interface to HTTP Basic Authentication, which is already implemented at protocol level.

This allows a looser coupling between modules (since Basic Auth is a common standard, the modules using authentication needn't know each other), and you can have one authentication system leveraging HTTP Basic Auth, and thus forwarding information to other modules.

It also allows you not to implement authentication at all and rely instead on the server's - e.g. with Apache's .htaccess/htpasswd.

Of course, in this latter case, things like password recovery and editing become proportionately more difficult, and in some setups, impossible unless you get a sysadmin to do it for you.

By the same token, methods using forms and _POST, possibly through AJAX, are often more portable between platforms (suppose you have a CGI configuration that doesn't support PHP_AUTH_*?), and allow more/easier customizability both in behaviour (e.g. logout, password caching) and interface (basic auth is done by the browser, and you usually get a standard browser dialog asking username and password, which might "clash" with your interface).

  • and about vulnerability ? – MihirUj Dec 29 '15 at 18:59
  • 1
    Vulnerabilities are caused by implementation details. Either could be used in both secure and insecure ways. – Jules Dec 29 '15 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.