Apache, cgi-bins, and the Authorization header

I had a problem: Server A runs a web service, which requires users to authenticate using the standard HTTP authentication mechanism. Server B should have web pages that use AJAX to query A's web services. Server B's web pages also require authentication, using the same scheme, backend and database as server A. There are two problems:

1. JavaScript web pages can only access web services/pages on the same server using XMLHttpRequest, for security reasons. Solution: Use a forwarding/proxy service. E.g. to access http://a.example.com/service from b.example.com add a service http://b.example.com/service that just forwards requests to the web service on A. This solution is quite straight forward.

2. Since B uses the same authentication scheme as A we need to forward authentication information passed to B's forwarding service on to A. Unfortunately this is not straight-forward, since the Apache HTTP Server provides no easy way to read the full authentication information passed to it via a cgi-bin. The only available information is the REMOTE_USER environment variable. This is not enough to construct a new Authentication header, though, since password information is stored encrypted in the account database.

   Finally I found a solution in Zope 2's documentation. Apache's mod_rewrite comes to the rescue. It allows you to read arbitrary HTTP headers and add arbitrary environment variables before executing a cgi-bin. The following recipe added to the appropriate .htaccess file adds a HTTP_AUTHORIZATION variable:

   RewriteEngine on
   RewriteBase /
   RewriteCond %{HTTP:Authorization}  ^(.*)
   RewriteRule ^(.*)$ $1 [e=HTTP_AUTHORIZATION:%1]
   

Apache, cgi-bins, and the Authorization header
by Michael
Friday, 9 February 2007 11:28

Thanks for this information! It solves a few problems I thought were going to be very difficult.

I've found that you can combine this with further rewrites and thus pass the authorization on to another URL, where it will appear in the environmental variable: REDIRECT_HTTP_AUTHORIZATION

Better Solution
by Christopher Vogt
Saturday, 13 February 2010 03:19

This produced an Internal Server Error for me. A better and working solution:

RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]