#Mamp pro authorization header missing code#

I don’t have access to the apache server directly. I’m executing the post request with Postman (Chrome addon) and I enabled CORS in my PHP script. It seems the Authorization header is somehow removed before it arrives at my PHP script. The Authorization header is populated with a token. Normally I can just stop there, accept that how things work in. Why does httpclient not have an Authorization header?Īutomatic redirection of HttpClient triggers the second request, and this one didn’t have any Authorization header.

Where is missing header in PHP POST request?īelow array holds request headers, that may be missing in $_SERVER variable (Especially true for ‘HTTP_X_REQUESTED_WITH’ ajax header, which will be found this way as: $headers The first one has the Authorization header and returns a 302 Found. Turns out, this was what happened behind the scene: There were actually 2 requests. Altogether working from a single request filter instead of a chain of filters or a big ball of mud.After having spent some time searching for solution on the Internet but to no avail, I opened Fiddler to see the actual HTTP requests. The Validator is anything I need to validate the token. The Handler only checks whether the request header Authorization informs the supported scheme.

In my case, adding new schemes was reduced to adding 2 new abstractions (implemented by the same concrete class): TokenHandler and TokenValidator. It provides me with clearness and understanding.

Technically, there could be very little or no difference between the two, but I have found the consistency to be a good feature. However, more room for design also meant more chances to overcomplicate things or reinvent the wheel. I had more room for design when I implemented custom headers. In my experience, both take me almost the same work and time to implement, with a slight difference. Shared caches won't cache the header (and that's good of course) unless you say otherwise. In the worse of the cases, it can also collide.Ĭollisions can be problematic, but all other issues are likely to be solved by tackling configurations. A custom header can be rejected or ignored. Say clients, say libraries, frameworks, reverse proxies.

#Mamp pro authorization header missing code#

Scheme can be unexpected and unsupported by some clients and leads to custom code anyway On the other hand, I found a consideration that a custom Authorization The problems I faced implementing my own schemes have been similar to the one commented. For example, I can redirect old schemes to specific versions of my web APIs which are deployed apart from the main ones. I also can apply specific rules in the API Gateways based on the authorization scheme. With the token's type informed I can invalidate requests from a specific set of clients (the outdated ones), add new schemes and differentiate old clients from new ones and change auth validations for one or another scheme without causing breaking changes. I started to be more consistent in the way I implement security so that I can keep backwards compatibility. I used to don't care about this, but after working with mobile clients or sensors, in which updates were not guaranteed, I started to. The way to communicate what kind of token we send and what authorization protocol should be applied should go in the header too. If we plan to use the Authorization header for all these protocols, we have to make our auth service consistent. Why do I think it is worth it? Because nowadays supporting different authentication or/and authorization protocols has become a must-have. Some may say this is unnecessary ( and not too long ago I would have agreed) but these days, with so many auth protocols, if we use the Authorization header to pass an API key, it is worth informing the type too because API keys are not self-descriptive per se 1.