simple basic auth for gateway index.php

index.php

<?php
/*
  in case you got a server config, that routes all calls through this index.php
  
  will not protect files, except you check the header with the server and re route to this script for validation.
  ... used this on IIS server. Apache, Nginx, Lightttpd, ... have simple onboard means.
*/


// simple auth
@session_start();
if ( !@$_SESSIOM['authed']  &&  !(@$_SERVER['PHP_AUTH_USER'] == 'admin' && @$_SERVER['PHP_AUTH_PW'] == 'password')) {
    header('WWW-Authenticate: Basic realm="Log in"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Sorry, you must authorize yourself.';
    exit;
} else {
    if (@$_SERVER['PHP_AUTH_USER'])
        $_SESSIOM['authed'] = true;
}


// ... regular stuff

• if you destroy the session, the user has to re-authorize! This is by purpose.