AppserverIo\Authenticator\BasicAuthenticator::authenticate()

Complexity

Conditions	6
Paths	5

Size

Total Lines	61
Code Lines	30

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	42

Importance

Changes	1
Bugs	0	Features	0

<?php
    public function authenticate(HttpServletRequestInterface $servletRequest, HttpServletResponseInterface $servletResponse)
    {

        // check if auth header is not set in coming request headers
        if ($servletRequest->hasHeader(Protocol::HEADER_AUTHORIZATION) === false) {
            // stop processing immediately
            $servletRequest->setDispatched(true);
            $servletResponse->setStatusCode(401);
            $servletResponse->addHeader(Protocol::HEADER_WWW_AUTHENTICATE, $this->getAuthenticateHeader());
            return false;
        }

        // load the raw login credentials
        $rawAuthData = $servletRequest->getHeader(Protocol::HEADER_AUTHORIZATION);

        // set auth hash got from auth data request header and check if username and password has been passed
        if (strstr($credentials = base64_decode(trim(strstr($rawAuthData, " "))), ':') === false) {

It seems like $rawAuthData can also be of type null; however, parameter $haystack of strstr() does only seem to accept string, maybe add an additional type check?

            // stop processing immediately
            $servletRequest->setDispatched(true);
            $servletResponse->setStatusCode(401);
            $servletResponse->addHeader(Protocol::HEADER_WWW_AUTHENTICATE, $this->getAuthenticateHeader());
            return false;
        }

        // get out username and password
        list ($username, $password) = explode(':', $credentials);

        // query whether or not a username and a password has been passed
        if (($password === null) || ($username === null)) {
            // stop processing immediately
            $servletRequest->setDispatched(true);
            $servletResponse->setStatusCode(401);
            $servletResponse->addHeader(Protocol::HEADER_WWW_AUTHENTICATE, $this->getAuthenticateHeader());
            return false;
        }

        // set username and password
        $this->username = new String($username);
        $this->password = new String($password);

        // load the realm to authenticate this request for
        /** @var AppserverIo\Appserver\ServletEngine\Security\RealmInterface $realm */
        $realm = $this->getAuthenticationManager()->getRealm($this->getRealmName());

        // authenticate the request and initialize the user principal
        $userPrincipal = $realm->authenticate($this->getUsername(), $this->getPassword());

        // query whether or not the realm returned an authenticated user principal
        if ($userPrincipal == null) {
            // stop processing immediately
            $servletRequest->setDispatched(true);
            $servletResponse->setStatusCode(401);
            $servletResponse->setBodyStream('Unauthorized');

'Unauthorized' of type string is incompatible with the type resource expected by parameter $bodyStream of AppserverIo\Psr\Servlet\Http\HttpServletResponseInterface::setBodyStream().

            $servletResponse->addHeader(Protocol::HEADER_WWW_AUTHENTICATE, $this->getAuthenticateHeader());
            return false;
        }

        // add the user principal and the authentication type to the request
        $servletRequest->setUserPrincipal($userPrincipal);

The method setUserPrincipal() does not exist on AppserverIo\Psr\Servlet\Http\HttpServletRequestInterface. It seems like you code against a sub-type of AppserverIo\Psr\Servlet\Http\HttpServletRequestInterface such as AppserverIo\Authenticator\Http\HttpServletRequestInterface.

        $servletRequest->setAuthType($this->getAuthType());

The method setAuthType() does not exist on AppserverIo\Psr\Servlet\Http\HttpServletRequestInterface.

        return true;
    }