Bug 29992 - Default Apache config should contain CGIPassAuth directive
Summary: Default Apache config should contain CGIPassAuth directive
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-02-01 10:44 UTC by Andrew Isherwood
Modified: 2023-09-27 07:16 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 29992: Add CGIPassAuth directive (1.32 KB, patch)
2022-02-01 10:47 UTC, Andrew Isherwood
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Isherwood 2022-02-01 10:44:29 UTC
By default, authorization headers are stripped out by Apache and therefore do not reach the underlying CGI script. This causes problems when Koha is receiving API requests that contain them as the client just receives a 401 response, even if a valid token was provided.

I propose we add the CGIPassAuth directive to the API Directory blocks.
Comment 1 Andrew Isherwood 2022-02-01 10:47:48 UTC
Created attachment 130038 [details] [review]
Bug 29992: Add CGIPassAuth directive
Comment 2 David Cook 2022-02-02 01:53:35 UTC
That's interesting, although why are you running the API as CGI and not as PSGI through Starman?
Comment 3 David Cook 2023-09-27 07:16:04 UTC
I still don't really understand this one and I don't think Andrew is coming back to work on it.