Authorization Credentials Stripped — PHP, elastic beanstalk, oauth

Question

I'm noticing my Elastic Beanstalk-deployed Laravel 5.1 API and S3 Angular static app are stripping my Auth Credentials from my requests. My API is using https://github.com/lucadegasperi/oauth2-server-laravel for OAuth2.

I followed this SO post on the issue, but seems it's directly related to a python deployment.

My EB deployment is running:

64bit Amazon Linux 2015.09 v2.0.4 running PHP 5.6

When I check my localhost requests, I see the Access headers are present:

http://dde-api.localhost/1.0/me/1/dashboard

Request:

Response:

On Staging, they are stripped:

Request:

Response:

http://dde.staging.com.s3-website-us-east-1.amazonaws.com/html/pages/dashboard.html

Likewise, I've posted using cURL and DHC to my API to get a token as usual, then make an API request to /dashboard, which works locally, but throws error:

{ "error": "invalid_request", "error_description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"access token\" parameter." }

How can I solve this issue with PHP? Is WSGIPassAuthorization a Python thing?

Answer 1

There is a bug in apache that strips the Authorization headers as it feels it isn't needed.

I solved it by modifying my Apache access rules file, .htaccess, (you can find this in your Laravel project), to check for this specific header, and make a copy of the header and pass it through:

# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]