10 May 2012 13:14
suPHP, Oauth and the Authorization Header
Hello,
I've been building an oauth server in php and get to the point of
testing. I've found that while running suPHP instead of mod_php the
authorization http header is completely missing. Here is an example GET
request:
GET /hello.php HTTP/1.1
Host: oauth
Connection: close
Accept-encoding: gzip, deflate
User-Agent: Zend_Http_Client
Authorization: OAuth realm="",oauth_consumer_key="a38223774a56f0af5ea40bd88285166504fab8e81",oauth_nonce="314e9c28d415feecea00e38fd0e500e2",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1336647473",oauth_version="1.0",oauth_token="e5cca21c8cfe266df76fd55c1acd9b2b04fab9605",oauth_signature="V6hD3kiuV%2FJVnu53G93TNJk2sXY%3D"
On the receiving side I get the Host, Accept-Encoding, User-Agent and
Connection headers but not the Authorization header.
Looking at the source for suPHP it appear in version 0.7.1-1 which I am
using the Authorization header is only parsed if it equates to the Basic
authentication type. Here is the url and code snippet:
if (r->headers_in) {
const char *auth;
auth = ap_table_get(r->headers_in,"Authorization");
if (auth&& auth[0] != 0&& strncmp(auth,"Basic", 6) == 0) {
char *user;
char *pass;
user = ap_pbase64decode(p, auth + 6);
if (user) {
pass = strchr(user,':');
(Continue reading)
RSS Feed