OAuth and Basic Auth together

Question

I have a web application that is using OAuth, and want to add Basic authentication as well to just view the page. I've modified my .htaccess file, added an .htpasswd file, and got the basic auth working. But now it breaks the OAuth on my application... I receive the following error:

Auth header found that doesn't start with "Token"

I'm using Tim Ridgely's oauth library, found here: http://code.google.com/p/oauth2-php/

Is there an easy way to get both of these auth models working together?

Answer 1

The problem is you only have one Authorization HTTP header and both the Basic and OAuth bearer token mechanisms use it.

In general, allowing multiple authorization mechanisms like this is best done by introducing a separate authorization component. For example, suppose you hosted a separate endpoint alongside your application that accepted basic auth, and in turn generated an OAuth token for your application to consume. Now your application only has to look for OAuth tokens.