[Fixed]-Apache strips down "Authorization" header

by

43👍

✅

I solved my problem, which finally was totally unrelated to my Apache configuration. So if you found this topic looking for an answer to the same problem, one of the solutions below should fix it :

Config WSGI : 

WSGIPAssAuthorization On

Config .htaccess :

RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

You can put both of those into your httpd/conf.d/project.conf file !

👤Martin Latrille

12👍

Several modules will strip the Authorization header to try to enhance security by preventing scripts from seeing usernames, passwords, etc… unless the developer explicitly enables this. Many of these modules will allow this header if you simply add the following line to .htaccess: CGIPassAuth on (source: Apache docs and StackOverflow)

👤BeetleJuice

1👍

To solve this problem, I just add WSGIPassAuthorization On to /etc/apache2/sites-available/mySite.conf file, as follows:

        ...
                </Files>
        </Directory>

        WSGIPassAuthorization On

        WSGIScriptAlias / /home/X/wsgi.py
        WSGIDaemonProcess sepanta_dev python-path=/home/X python-home=/home/X/venv
        ...
👤Mohammad Nazari

Leave a comment