Slim: Unable to catch Authorization header

[ikhsan017]

Hi All,

I was trying to catch HTTP Authorization header by accessing $app->request->headers->get('Authorization') but I get nothing in return

here is how to reproduce the issue:

The Accept-Encoding header is shown as gzip, deflate, but the Authorization header doesn't shows up.

I am using firefox as browser, and jquery to send ajax request, append custom header for Authorization

$.ajax({
    method: 'POST',
    url: 'header',
    data: {test: 'test'},
    headers: {
        'Authorization' : 'test auth'
    }
});

here is what I get from request headers tab on firebug

Accept  */*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Authorization   test auth
Content-Length  9
Content-Type    application/x-www-form-urlencoded; charset=UTF-8
Cookie  /** hidden **/
Host    localhost
Referer http://localhost/github/Slim/public/
User-Agent  Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:29.0) Gecko/20100101 Firefox/29.0
X-Requested-With    XMLHttpRequest

and here is my route and controller

$app->post('header', 'HomeController:headerTest');

Class HomeController
{
    protected $app;

    public function __construct(){
        $this->app = \Slim\Slim::getInstance();
    }

    public function headerTest(){
        echo $this->app->request->headers->get('Accept-Encoding');
        echo $this->app->request->headers->get('Authorization');
    }
}

[tuupola]

Basic authentication header should look something like this.

Authorization: Basic cm9vdDp0MDBy

Authentication most likely fails because of non standard header. You can also pass credentials like this:

$.ajax({
    method: "POST",
    url: "/admin",
    username: "root",
    password: "t00r"
});

With Slim 2.4.3 I am able to access Authorization header via both $app->request->headers->get("Authorization") and $_SERVER["HTTP_AUTHORIZATION"].

<?php

require "vendor/autoload.php";

$app = new \Slim\Slim();

$app->add(new \Slim\Middleware\HttpBasicAuthentication(array(
    "path" => "/admin",
    "realm" => "Here be dragons.",
    "users" => array(
        "root" => "t00r",
        "user" => "passw0rd"
    )
)));

$app->get("/admin", function() use ($app) {
    var_dump($app->request->headers->get("Authorization"));
    var_dump($_SERVER["HTTP_AUTHORIZATION"]);
});

$app->run();

Gives the following result:

string 'Basic cm9vdDp0MDBy' (length=18)
string 'Basic cm9vdDp0MDBy' (length=18)

[DavidePastore]

This answer could be helpful.

[josephdpurcell]

I ran into this same issue. I discovered Josh Lockhart's (@codeguy) comment on the Slim forums.

There, he refers to Volker Grabsch's (@vog) comment on PHP manual which explains that PHP only parses the Authorization header for Basic and Digest.

The solution suggested there is to have Apache rewrite the header to essentially prefix "HTTP_" which will then allow PHP to parse it properly.

RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

I don't know the backstory on why PHP has such strict regulations on parsing the Authorization header. Hopefully, PHP will at least support OAuth soon as this is a common problem, e.g. the PHP oauth package has reported a related bug.

I think it would be great if Slim supported this in the mean time by modifying Slim/Environment.php to pull the Authorization header from the request and adding it to the environment. Then, modify Slim/Http/headers.php to add 'AUTHORIZATION' to the special headers.

[josephdpurcell]

It looks like Mika Tuupola (@tuupola) may have indirectly encountered this issue as well as indirectly noted in PR https://github.com/codeguy/Slim/pull/898 and is using the Apache rewrite rule.

It looks like there isn't a really easy solution for this since the only thing you can get from PHP is All The Things!™ (see getallheaders).

[tuupola]

With current version of Slim if you add the following to .htaccess file.

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

You can then access even non standard header with any of these.

print $_SERVER["HTTP_AUTHORIZATION"];
print apache_request_headers()["Authorization"];
print $app->request->headers("Authorization");

[josephdpurcell]

@tuupola How would you suggest this to work under nginx + php-fpm? Have nginx rewrite the header as well?

[craigify]

I'd like to note that with Apache 2.4.7, PHP 5.6.15 with Apache mod_proxy_fcgi PHP-FPM using a ProxyMassMatch directive to send *.php requests over to PHP, setting an environment variable "HTTP_AUTHENTICATION" gets mangled by something, and I wind up with $_SERVER['REDIRECT_HTTP_AUTHENTICATION'] instead. I am not sure where the 'REDIRECT_' part is coming from, but you might want to also check for this as an edge case. I haven't figured out why yet, and I've had to add a kludge fix to look for this specifically.

[tuupola]

This is an undocumented Apache "feature". There was a https://github.com/slimphp/Slim/pull/898 for Slim 2. Something similar could be done for Slim 3.

[Procaseycash]

while using this in .htaccess, i got 500 error;
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

[grimgit]

You can allow Apache to forward the Auth header with the directive:
CGIPassAuth On

You can put it in your .htaccess or in the apache configuration

[jeansordes]

I've stumbled upon this as well, and because I found this on Google in the first results here is how I managed it

$request->getHeader("Authorization");