Yes it is done in init() in lib/base.php, before tryBasicAuthLogin :

if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SESSION['user_id']) &&
$_SERVER['PHP_AUTH_USER'] != $_SESSION['user_id']) {
                        OC_User::logout();
}

If PHP_AUTH_USER changes, session is destroyed and cookies are removed (in
logout()).

Later in handleRequest the user will be authenticated again with new
credentials.

So in my opinion its not necessary to check that again.

Regards,
Stephane



On Mon, Aug 26, 2013 at 8:54 PM, Thomas Müller <notifications@github.com>wrote:

> In lib/base.php:
>
> > @@ -795,11 +795,16 @@ protected static function tryBasicAuthLogin() {
> >  		) {
> >  			return false;
> >  		}
> > -		OC_App::loadApps(array('authentication'));
> > -		if (OC_User::login($_SERVER["PHP_AUTH_USER"], $_SERVER["PHP_AUTH_PW"])) {
> > -			//OC_Log::write('core',"Logged in with HTTP Authentication", OC_Log::DEBUG);
> > -			OC_User::unsetMagicInCookie();
> > -			$_SERVER['HTTP_REQUESTTOKEN'] = OC_Util::callRegister();
> > +		// don't redo authentication if user is already logged in
> > +		// otherwise session would be invalidated in OC_User::login with
> > +		// session_regenerate_id at every page load
> > +		if (!OC_User::isLoggedIn()) {
>
> In case the user is logged in: should we double check the session belongs
> to the the user in $_SERVER["PHP_AUTH_USER"]
>
> We have such a check in place afaik - the question is if this check is
> executed in case of basic auth
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/owncloud/core/pull/4578/files#r5986235>
> .
>