# HttpHeaderAuth

> HttpHeaderAuth is an action filter that supports HTTP authentication through HTTP Headers.

[API reference](/docs/api/index.md) › [yii](/docs/api/yii/index.md) › [filters](/docs/api/yii/filters/index.md) › [auth](/docs/api/yii/filters/auth/index.md) › HttpHeaderAuth

| class | `yii\filters\auth\HttpHeaderAuth` |
| --- | --- |
| Extends | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) » [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) » [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) » [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| Implements | [`AuthInterface`](/docs/api/yii/filters/auth/authinterface/index.md), [`yii\base\Configurable`](/docs/api/yii/base/configurable/index.md) |
| Since | 2.0.14 |
| Source | [`framework/filters/auth/HttpHeaderAuth.php`](https://github.com/yiisoft/yii2/blob/22.0/framework/filters/auth/HttpHeaderAuth.php#L40) |

1 subclass:

- [`HttpBearerAuth`](/docs/api/yii/filters/auth/httpbearerauth/index.md)

HttpHeaderAuth is an action filter that supports HTTP authentication through HTTP Headers.

You may use HttpHeaderAuth by attaching it as a behavior to a controller or module, like the following:

```
public function behaviors()
{
    return [
        'basicAuth' => [
            'class' => \yii\filters\auth\HttpHeaderAuth::class,
        ],
    ];
}
```

The default implementation of HttpHeaderAuth uses the [loginByAccessToken()](/docs/api/yii/web/user/index.md#method-loginByAccessToken)
method of the `user` application component and passes the value of the `X-Api-Key` header. This implementation is used
for authenticating API clients.

## Properties

| Property | Type | Description | Defined by |
| --- | --- | --- | --- |
| <span id="property-except"></span>[`$except`](/docs/api/yii/base/actionfilter/index.md#property-except) | `array` | List of action IDs that this filter should not apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-header"></span>`$header` | `string` | The HTTP header name Default: `'X-Api-Key'`. | `HttpHeaderAuth` |
| <span id="property-only"></span>[`$only`](/docs/api/yii/base/actionfilter/index.md#property-only) | `array` | List of action IDs that this filter should apply to. Default: `[]`. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="property-optional"></span>[`$optional`](/docs/api/yii/filters/auth/authmethod/index.md#property-optional) | `array` | List of action IDs that this filter will be applied to, but auth failure will not lead to error. Default: `[]`. Available since 2.0.7. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-owner"></span>[`$owner`](/docs/api/yii/base/behavior/index.md#property-owner) | `yii\base\T\|null` | The owner of this behavior Default: `null`. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="property-pattern"></span>`$pattern` | `string` | A pattern to use to extract the HTTP authentication value Default: `null`. | `HttpHeaderAuth` |
| <span id="property-request"></span>[`$request`](/docs/api/yii/filters/auth/authmethod/index.md#property-request) | [`yii\web\Request`](/docs/api/yii/web/request/index.md)`\|null` | The current request. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-response"></span>[`$response`](/docs/api/yii/filters/auth/authmethod/index.md#property-response) | [`yii\web\Response`](/docs/api/yii/web/response/index.md)`\|null` | The response to be sent. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="property-user"></span>[`$user`](/docs/api/yii/filters/auth/authmethod/index.md#property-user) | [`yii\web\User`](/docs/api/yii/web/user/index.md)`\|null` | The user object representing the user authentication status. Default: `null`. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Methods

| Method | Description | Defined by |
| --- | --- | --- |
| <span id="method-__construct"></span>[`__construct()`](/docs/api/yii/base/baseobject/index.md#method-__construct) | Constructor. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__call"></span>[`__call()`](/docs/api/yii/base/baseobject/index.md#method-__call) | Calls the named method which is not a class method. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__get"></span>[`__get()`](/docs/api/yii/base/baseobject/index.md#method-__get) | Returns the value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__isset"></span>[`__isset()`](/docs/api/yii/base/baseobject/index.md#method-__isset) | Checks if a property is set, i.e. defined and not null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__set"></span>[`__set()`](/docs/api/yii/base/baseobject/index.md#method-__set) | Sets value of an object property. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__unset"></span>[`__unset()`](/docs/api/yii/base/baseobject/index.md#method-__unset) | Sets an object property to null. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-afterAction"></span>[`afterAction()`](/docs/api/yii/base/actionfilter/index.md#method-afterAction) | This method is invoked right after an action is executed. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-afterFilter"></span>[`afterFilter()`](/docs/api/yii/base/actionfilter/index.md#method-afterFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-attach"></span>[`attach()`](/docs/api/yii/base/actionfilter/index.md#method-attach) | Attaches the behavior object to the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| [`authenticate()`](#method-authenticate) | Authenticates the current user. | `HttpHeaderAuth` |
| <span id="method-beforeAction"></span>[`beforeAction()`](/docs/api/yii/filters/auth/authmethod/index.md#method-beforeAction) | This method is invoked right before an action is to be executed (after all possible filters.) You may override this method to do last-minute preparation for the action. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-beforeFilter"></span>[`beforeFilter()`](/docs/api/yii/base/actionfilter/index.md#method-beforeFilter) |  | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-canGetProperty"></span>[`canGetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canGetProperty) | Returns a value indicating whether a property can be read. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-canSetProperty"></span>[`canSetProperty()`](/docs/api/yii/base/baseobject/index.md#method-canSetProperty) | Returns a value indicating whether a property can be set. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-challenge"></span>[`challenge()`](/docs/api/yii/filters/auth/authmethod/index.md#method-challenge) | Generates challenges upon authentication failure. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-className"></span>[`className()`](/docs/api/yii/base/baseobject/index.md#method-className) static | Returns the fully qualified name of this class. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-detach"></span>[`detach()`](/docs/api/yii/base/actionfilter/index.md#method-detach) | Detaches the behavior object from the component. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-events"></span>[`events()`](/docs/api/yii/base/behavior/index.md#method-events) | Declares event handlers for the [`$owner`](/docs/api/yii/base/behavior/index.md#property-owner)'s events. | [`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md) |
| <span id="method-handleFailure"></span>[`handleFailure()`](/docs/api/yii/filters/auth/authmethod/index.md#method-handleFailure) | Handles authentication failure. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |
| <span id="method-hasMethod"></span>[`hasMethod()`](/docs/api/yii/base/baseobject/index.md#method-hasMethod) | Returns a value indicating whether a method is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-hasProperty"></span>[`hasProperty()`](/docs/api/yii/base/baseobject/index.md#method-hasProperty) | Returns a value indicating whether a property is defined. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-init"></span>[`init()`](/docs/api/yii/base/baseobject/index.md#method-init) | Initializes the object. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-getActionId"></span>[`getActionId()`](/docs/api/yii/base/actionfilter/index.md#method-getActionId) protected | Returns an action ID by converting [`Action::$uniqueId`](/docs/api/yii/base/action/index.md#property-uniqueId) into an ID relative to the module. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isActive"></span>[`isActive()`](/docs/api/yii/base/actionfilter/index.md#method-isActive) protected | Returns a value indicating whether the filter is active for the given action. | [`yii\base\ActionFilter`](/docs/api/yii/base/actionfilter/index.md) |
| <span id="method-isOptional"></span>[`isOptional()`](/docs/api/yii/filters/auth/authmethod/index.md#method-isOptional) protected | Checks, whether authentication is optional for the given action. | [`AuthMethod`](/docs/api/yii/filters/auth/authmethod/index.md) |

## Method details

### authenticate() <span id="method-authenticate"></span>

```php
public function authenticate(mixed $user, mixed $request, mixed $response): yii\web\IdentityInterface|null
```

Authenticates the current user.

**Parameters**

| Parameter | Type | Description |
| --- | --- | --- |
| `$user` | `mixed` |  |
| `$request` | `mixed` |  |
| `$response` | `mixed` |  |

**Returns**

[`yii\web\IdentityInterface`](/docs/api/yii/web/identityinterface/index.md)`|null`: The authenticated user identity. If authentication information is not provided, null will be returned.

**Throws**

- [`yii\web\UnauthorizedHttpException`](/docs/api/yii/web/unauthorizedhttpexception/index.md): if authentication information is provided but is invalid.