j.foucher
466755ddc2
OVH mutualisé serves PHP via FastCGI which strips the Authorization
header by default for security. The user's curl test of GET
/api/download-url/{ver} returned 401 even with -H "Authorization:
Bearer <key>" because $_SERVER['HTTP_AUTHORIZATION'] was empty server-side.
Fix on two layers:
1. .htaccess at root re-injects the header into the Apache env so PHP
can read it via the standard $_SERVER variable. The mod_rewrite
one-liner `RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1]` is the de-
facto FastCGI workaround.
2. DownloadUrl.php now reads from any of: $_SERVER['HTTP_AUTHORIZATION'],
$_SERVER['REDIRECT_HTTP_AUTHORIZATION'] (passthrough variant),
apache_request_headers(), getallheaders(). Belt and braces — works
regardless of host config. Falls back to ?key= as before.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
22 lines
852 B
ApacheConf
22 lines
852 B
ApacheConf
RewriteEngine On
|
|
RewriteBase /PS_Launcher/
|
|
|
|
# Forward du header Authorization vers PHP — Apache FastCGI le strippe par défaut
|
|
# sur OVH mutualisé. Sans ça, $_SERVER['HTTP_AUTHORIZATION'] est vide quand le
|
|
# client envoie "Authorization: Bearer ...".
|
|
RewriteCond %{HTTP:Authorization} ^(.+)$
|
|
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%1,L=0]
|
|
|
|
# HTTPS forcé (si le mutualisé OVH ne le force pas déjà)
|
|
RewriteCond %{HTTPS} off
|
|
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
|
|
|
# Pas de listing de répertoires
|
|
Options -Indexes
|
|
|
|
# /PS_Launcher/api -> api/index.php
|
|
# /PS_Launcher/api/foo -> api/index.php?route=foo
|
|
# (passage par query string : pas de PATH_INFO, marche partout)
|
|
RewriteRule ^api/?$ api/index.php [QSA,L]
|
|
RewriteRule ^api/([^?]+)/?$ api/index.php?route=$1 [QSA,L]
|