如何为CodeIgniter 4 REST API添加HTTP基础身份验证？

实现步骤： #

• 第一步：定义固定认证凭证
  在控制器里直接设置单用户的用户名和密码：

  private $validUser = 'api_user';
  private $validPass = 'api_pass123';
  

• 第二步：编写认证检查逻辑
  新增一个私有方法，负责解析HTTP请求头里的认证信息并验证：

  private function checkAuth()
  {
      $authHeader = $this->request->getServer('HTTP_AUTHORIZATION');
      
      // 检查是否存在合法的Basic认证头
      if (!$authHeader || strpos($authHeader, 'Basic ') !== 0) {
          return false;
      }
  
      // 解码Base64格式的凭证
      $credentials = base64_decode(substr($authHeader, 6));
      list($user, $pass) = explode(':', $credentials, 2);
  
      // 验证凭证是否匹配
      return ($user === $this->validUser && $pass === $this->validPass);
  }
  

• 第三步：在请求处理前校验认证
  在create方法开头调用认证检查，失败则直接返回401未授权响应。

修改后的完整控制器代码： #

namespace AppControllers;
use CodeIgniterRESTfulResourceController;
use CodeIgniterAPIResponseTrait;
use AppModelsApiModel;
use ConfigServices;

class Api extends ResourceController {

    use ResponseTrait;
    protected $request;
    
    // 单用户认证凭证
    private $validUser = 'api_user';
    private $validPass = 'api_pass123';

    public function create() {
        // 先执行认证校验
        if (!$this->checkAuth()) {
            $response = [
                'status'   => 401,
                'error'    => 'Unauthorized',
                'messages' => [
                    'error' => '认证凭证无效或缺失'
                ]
            ];
            return $this->respond($response, 401);
        }

        $model = new ApiModel();
            
        $data = [
            'uid' => $this->request->getPost('uid'),
            'request' => $this->request->getPost('request'),
            'data' => $this->request->getPost('data')
        ];
             
        $model->insert($data);

        $response = [
            'status'   => 201,
            'error'    => null,
            'messages' => [
                'success' => '数据已保存'
            ]
        ];
             
        return $this->respondCreated($data, 201);
    }

    // 私有认证检查方法
    private function checkAuth()
    {
        $authHeader = $this->request->getServer('HTTP_AUTHORIZATION');
        
        if (!$authHeader || strpos($authHeader, 'Basic ') !== 0) {
            return false;
        }

        $credentials = base64_decode(substr($authHeader, 6));
        list($user, $pass) = explode(':', $credentials, 2);

        return ($user === $this->validUser && $pass === $this->validPass);
    }
}

测试说明： #

发送POST请求时，需在请求头中添加Authorization字段，格式为Basic [Base64编码的用户名:密码]。比如把api_user:api_pass123转成Base64后得到YXBpX3VzZXI6YXBpX3Bhc3MxMjM=，对应的请求头就是：

Authorization: Basic YXBpX3VzZXI6YXBpX3Bhc3MxMjM=

内容的提问来源于stack exchange，提问作者Ping