Apache ProxyPass removes Authorization header

apache authorization proxypass
Gert-Jan picture Gert-Jan · Jun 27, 2016 · Viewed 8.3k times · Source

I have an Apache server setup as a reverse proxy in front of a some backend servers. One of the backend servers requires basic authentication but somehow Apache seems to remove the Authorization header from the request.

Do I have to configure something special in order to make Apache pass on the Authorization header to the backend server?

My Apache configuration is pretty basic. I only added some proxy directives like:

ProxyRequests Off
ProxyPass /backend-server https://backend.server

SSLProxyEngine on

Answer

nidhi picture nidhi · Jun 27, 2016

You will have to set the proxy-chain-auth environment variable:

If the proxy requires authentication, it will read and consume the proxy authentication credentials sent by the client. With proxy-chain-auth it will also forward the credentials to the next proxy in the chain. This may be necessary if you have a chain of proxies that share authentication information. Security Warning: Do not set this unless you know you need it, as it forwards sensitive information!

http://httpd.apache.org/docs/2.2/mod/mod_proxy_http.html

<Location />
    AuthType basic
    SetEnv proxy-chain-auth 
</Location>

Related questions

htaccess exclude one url from Basic Auth

I need to exclude one Url (or even better one prefix) from normal htaccess Basic Auth protection. Something like /callbacks/myBank or /callbacks/.* Do you have any hints how to do it? What I'm not looking for is how to …

Read More
Authorization header missing in PHP POST request

I'm currently trying to read the authorization header in a PHP script that I'm calling with a POST request. The Authorization header is populated with a token. It seems the Authorization header is somehow removed before it arrives at my …

Read More
Authorization header missing in django rest_framework, is apache to blame?

I've managed to extend TokenAuthentication and I have a working model when using the request session to store my tokens, however when I attempt to pass Authorization as a header parameter as described here, I noticed that my Responses come …

Read More