Bug 29992

Summary: Default Apache config should contain CGIPassAuth directive
Product: Koha Reporter: Andrew Isherwood <bugzilla>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: Failed QA --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 29992: Add CGIPassAuth directive

Description Andrew Isherwood 2022-02-01 10:44:29 UTC
By default, authorization headers are stripped out by Apache and therefore do not reach the underlying CGI script. This causes problems when Koha is receiving API requests that contain them as the client just receives a 401 response, even if a valid token was provided.

I propose we add the CGIPassAuth directive to the API Directory blocks.
Comment 1 Andrew Isherwood 2022-02-01 10:47:48 UTC
Created attachment 130038 [details] [review]
Bug 29992: Add CGIPassAuth directive
Comment 2 David Cook 2022-02-02 01:53:35 UTC
That's interesting, although why are you running the API as CGI and not as PSGI through Starman?
Comment 3 David Cook 2023-09-27 07:16:04 UTC
I still don't really understand this one and I don't think Andrew is coming back to work on it.