php - 验证 AP WebFeed 请求

Question

我正在尝试实现一种 PHP 方法来验证对美联社供稿的请求。来自他们的文档:

To authenticate all feed and content requests, the AP WebFeeds system uses HTTP Basic Authentication, which is currently the standard for syndicated feeds. Most feed readers and reader components allow the configuration of user credentials ahead of time and pass them in the headers rather than in the URL.

Important: Passing the credentials directly in the URL is currently widely blocked. For more information, see Microsoft’s security bulletin at http://www.microsoft.com/technet/security/bulletin/MS04-004.mspx.

You can configure a reader or component to create an authentication header with the name / value in the following format:

("Authorization", "Basic " + {Encoded_username_and_password})

where {Encoded_username_and_password} is replaced with the Base64 encoding of the bytes in the string "username:password."

If you are writing your own client code to download a feed, use HTTP Basic Authentication that is built into your programming language’s library. HTTP Basic Authentication is available on most platforms; for example, Perl, PHP, C or Java.

我的尝试是:

 /**
 * Begin Transaction
 */

$url = "http://syndication.ap.org/AP.Distro.Feed/GetFeed.aspx?idList=" . implode(',', $idList) . "&idListType=products&maxItems=25";    
$auth = "Authorization=Basic " . base64_encode($user . ":" . $pass);    
$ch = curl_init();  // initialize curl handle   
curl_setopt($ch, CURLOPT_URL, $url); // set url to post to  
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); // return into a variable   
curl_setopt($ch, CURLOPT_POST, 1); // set POST method   
curl_setopt($ch, CURLOPT_POSTFIELDS, $auth); // add POST fields 
$result = curl_exec($ch); // run the whole process  
curl_close($ch);

/**
 * End Transaction
 */

var_dump($result);

这给了我:

string(405) "

    Authentication
    FeedServer
    Authentication Failed on GetFeed

    Authentication denied no auth credentials detected

"

在 PHP 中验证此请求的正确方法是什么？

( See also the provided ASP.NET and Java examples )

Answer 1

Authorization is an HTTP header不是 POST 参数。您使用了设置请求正文的 CURLOPT_POSTFIELDS。相反，您需要使用 CURLOPT_HTTPHEADER 来设置它(它的条目在列表中很靠后):

curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Basic ' . base64_encode($user . ":" . $pass)));

如果还不是很明显，您不需要将其作为发布请求(除非 API 要求)，因此您可以删除:

curl_setopt($ch, CURLOPT_POST, 1); // set POST method