Authorization Header not passed to PHP in some instances.

[Karl]

Hi,

We're seeing an issue (tested on several of our installed) where if a request sets an authorization header as such:

Authorization: Apikey <key>

This does not get set in PHP and HTTP_AUTHORIZATION is not present. The same happens with Digest as well.

If the request uses Basic or Bearer then HTTP_AUTHORIZATION is set.

This is using LSAPI, not CGI:

Server API: LiteSpeed V7.7

Issue would appear to be LSAPI rather than Litespeed, as the same happens on an Apache server using LSAPI to connect to PHP as well.

Thanks,

Karl

 

[NiteWave]

I did a quick test:
#curl -H "Authorization:Apikey <key>" -o p.html http://domain.com/phpinfo.php
then access http://domain.com/p.html

$_SERVER['HTTP_AUTHORIZATION']  Apikey <key>

it's there

can you do similar simple tests