Better authentication handling in EE - custom 401 and 403 HTTP error code pages

Question

I submitted this as a bug to Ellis Labs over two weeks ago but have not had an acknowledgement that it is even a bug, so I am turning here to hopefully get some help. A similar question is still unanswered...

Versions: PHP v.5.5.25, EE v.2.10.1

---

EE provides the ability to create a custom 404 error page. However, it does not provide the ability to create custom 401 or 403 HTTP code error pages, unlike other web development frameworks. It uses HTTP authentication and authorization throughout the CMS so this seems very odd. Searching the EE core shows where this is implemented, and it seems very much like a sledgehammer approach.

In system/expressionengine/libraries/Auth.php:

132         // ------------------------------------------------
133 
134         /**
135          * Authenticate from basic http auth
136          *
137          * @access      public
138          */
139         public function authenticate_http_basic($not_allowed_groups = array(),
140                                                 $realm='Authentication Required')
141         {
142                 $always_disallowed = array(2, 3, 4);
143 
144                 $not_allowed_groups = array_merge($not_allowed_groups,
                                                      $always_disallowed);
145 
146                 $authed = $this->_retrieve_http_basic();
147 
148                 if ($authed !== FALSE)
149                 {
150                         if (in_array($authed->member('group_id'),
                                         $not_allowed_groups))
151                         {
152                                 $authed = FALSE;
153                         }
154                 }
155 
156                 if ($authed === FALSE)
157                 {
158                         @header('WWW-Authenticate: Basic realm="'.$realm.'"');
159                         ee()->output->set_status_header(401);
160                         @header("Date: ".gmdate("D, d M Y H:i:s")." GMT");
161                         exit("HTTP/1.0 401 Unauthorized");
162                 }
163 
164                 return TRUE;
165         }

The code uses EE to set a status header and then uses the raw PHP exit() function (line 161) to dump out a string. There is no way to actually subclass this functionality and create a custom 401 or 403 error page.

Note: I cannot even find a place where 403 errors are handled.

Does anyone know how I can give the control of authentication and error document handling back to Apache? Right now EE hijacks the process. I don't really want to hack the EE core (because that would require hacking the source of every subsequent upgrade). Are there some 3rd party EE plugins that do authentication and authorization in a more graceful way?

Thanks in advance.

Answer 1

Almost two years later there is a response from the Expression Engine support team:

The above method is for HTTP Auth access control of a template, when enabled in a template’s settings. This optional feature uses an appropriate solution when PHP is given the task of providing this functionality. ref: http://php.net/manual/en/features.http-auth.php

It is not possible to throw the responsibility back to Apache from PHP to use custom server error pages. So, this it not a bug, but your feature request to allow customization within the CMS for HTTP Auth failure is noted and I will share it with the team.

No ETA on when the feature will be implemented.