j.foucher/PS_Launcher
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DownloadUrl: tolerate Apache FastCGI stripping the Authorization header

Browse Source 
OVH mutualisé serves PHP via FastCGI which strips the Authorization
header by default for security. The user's curl test of GET
/api/download-url/{ver} returned 401 even with -H "Authorization:
Bearer <key>" because $_SERVER['HTTP_AUTHORIZATION'] was empty server-side.

Fix on two layers:

1. .htaccess at root re-injects the header into the Apache env so PHP
   can read it via the standard $_SERVER variable. The mod_rewrite
   one-liner `RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1]` is the de-
   facto FastCGI workaround.

2. DownloadUrl.php now reads from any of: $_SERVER['HTTP_AUTHORIZATION'],
   $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] (passthrough variant),
   apache_request_headers(), getallheaders(). Belt and braces — works
   regardless of host config. Falls back to ?key= as before.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
j.foucher
2026-05-02 11:26:38 +02:00
parent 6da628d687
commit 466755ddc2
2 changed files with 33 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/.htaccess
View File

@@ -1,6 +1,12 @@
RewriteEngine On RewriteEngine On
RewriteBase /PS_Launcher/ RewriteBase /PS_Launcher/
# Forward du header Authorization vers PHP — Apache FastCGI le strippe par défaut
# sur OVH mutualisé. Sans ça, $_SERVER['HTTP_AUTHORIZATION'] est vide quand le
# client envoie "Authorization: Bearer ...".
RewriteCond %{HTTP:Authorization} ^(.+)$
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1,L=0]
# HTTPS forcé (si le mutualisé OVH ne le force pas déjà) # HTTPS forcé (si le mutualisé OVH ne le force pas déjà)
RewriteCond %{HTTPS} off RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

35
server/api/routes/DownloadUrl.php
View File

@@ -24,15 +24,34 @@ final class DownloadUrl
} }
// Auth via Authorization: Bearer <licenseKey> // Auth via Authorization: Bearer <licenseKey>
$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? ''; // Apache OVH (et autres hébergements FastCGI) strippe parfois le header. On
if (!preg_match('/^Bearer\s+(.+)$/i', $authHeader, $m)) { // tente plusieurs sources :
// Fallback : certains hébergements masquent Authorization. On accepte aussi ?key= // - $_SERVER['HTTP_AUTHORIZATION'] (cas standard)
$licenseKey = trim((string)($_GET['key'] ?? '')); // - $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] (mod_rewrite passthrough)
if ($licenseKey === '') { // - apache_request_headers() (présent quand mod_php)
Response::error('unauthorized', 'License key requise (Authorization: Bearer ... ou ?key=...)', 401); // - getallheaders() (idem)
} // - ?key=... (fallback explicite)
} else { $authHeader = $_SERVER['HTTP_AUTHORIZATION']
?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION']
?? '';
if ($authHeader === '' && function_exists('apache_request_headers')) {
$h = apache_request_headers();
$authHeader = $h['Authorization'] ?? $h['authorization'] ?? '';
}
if ($authHeader === '' && function_exists('getallheaders')) {
$h = getallheaders();
$authHeader = $h['Authorization'] ?? $h['authorization'] ?? '';
}
$licenseKey = '';
if (preg_match('/^Bearer\s+(.+)$/i', $authHeader, $m)) {
$licenseKey = trim($m[1]); $licenseKey = trim($m[1]);
} else {
$licenseKey = trim((string)($_GET['key'] ?? ''));
}
if ($licenseKey === '') {
Response::error('unauthorized',
'License key requise (Authorization: Bearer ... ou ?key=...)', 401);
} }
$db = Db::get($config); $db = Db::get($config);