Edit report at https://bugs.php.net/bug.php?id=72915&edit=1
ID: 72915
Updated by: [email protected]
Reported by: cpuidle at gmx dot de
-Summary: HTTP_AUTORIZATION header missing for Bearer Auth
when using apache module
+Summary: *Only* basic and digest authentication supported
-Status: Open
+Status: Verified
-Type: Bug
+Type: Documentation Problem
-Package: Apache2 related
+Package: *Web Server problem
Operating System: OSX
PHP Version: 7.0.10
-Assigned To:
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
> […] it seems that PHP _only_ supports Basic and Digest
> authorization and nothing else.
Right; regardless of the SAPI. The manual, apparently a bit
outdated, claims[1]:
| Both "Basic" and "Digest" authentication methods are supported.
Use the oauth extension for bearer authentication (or a PHP
library, or roll your own :).
[1] <https://www.php.net/manual/en/features.http-auth.php>
Previous Comments:
------------------------------------------------------------------------
[2016-08-26 07:34:22] cpuidle at gmx dot de
Looking at https://github.com/php/php-src/blob/9fc0a5e049ade8082b2b9a45687ac8cbd694f731/main/main.c#L2615 it seems that PHP _only_ supports Basic and Digest authorization and nothing else.
------------------------------------------------------------------------
[2016-08-26 07:17:34] cpuidle at gmx dot de
To be clear: the $_SERVER['HTTP_AUTHORIZATION'] variable is empty while apache_request_headers() shows that the Authorization header is indeed present.
It doesn't seem to get picked up by PHP, but why?
------------------------------------------------------------------------
[2016-08-21 21:02:53] cpuidle at gmx dot de
Description:
------------
echo $_SERVER['HTTP_AUTHORIZATION']
Test script:
---------------
curl --header "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0NzE4MDMwNjYsImV4cCI6MTQ3MTg4OTQ2Niwic3ViIjoidXNlciJ9.1JSvKan_gh5nV6wsLBbmZ0KrO9NKhHX7ktcmzxgtMHM" http://localhost/test.php
Expected result:
----------------
Show authorization header
Actual result:
--------------
$_SERVER['HTTP_AUTHORIZATION'] not present
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72915&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.