r3h6 / TYPO3.EXT.oidc_server

GNU General Public License v2.0
0 stars 1 forks source link

Authorisation-Header is empty even if present #3

Open typoworx-de opened 2 years ago

typoworx-de commented 2 years ago

I found a bug that is caused by HTTP-Foundation (Symfony Request) https://github.com/symfony/symfony/issues/19693

The Authorisation-Header always keeps to be empty, as the ServerRequest-Object seems to not pass it correctly. I was able to fix that by adding this to Apache2 .htaccess (for NGINX it should work as well, but with other configuration):

# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

The rewrite will pass the Authorisation-Header as HTTP_AUTHORIZATION, which then is parsed by ServerRequest-Object as 'authorisation'-Header and fixes this issue.

I did not find anything about that in the documentation yet, so I think that should be clarified more present to new integrators using this TYPO3 Extension.