Basic PHP Password Hashing

1-signup.php

<?php

$user = new User;
$user->email = 'foo@example.com';
$user->password_digest = password_hash('mypassword', PASSWORD_DEFAULT);
$user->save();

2-login.php

<?php

$providedEmail = $_SERVER['PHP_AUTH_USER'];
$providedPassword = $_SERVER['PHP_AUTH_PW'];

$user = User::find_by_email($providedEmail);
if ($user) {
    if (password_verify($providedPassword, $user->password_digest)) {
        session_start();
        $_SESSION['user_id'] = $user->id;
        
        header('HTTP/1.1 200 Ok');
        header('Location: https://example.com/my-account');
        echo 'You have successfully logged in!';
        exit();
    }
}

header('HTTP/1.1 403 Forbidden');
echo 'You provided an invalid email/password';