PHP as CGI: Missing OAuth HTTP Authorization header for inbound moderation requests

Hm. This interaction is constantly tested actually. And I even took the time to test the full interaction once more manually for this issue now, but I'm not able to reproduce the issue.

Since you're saying that you're moderating the content from the moderation system, this means that your site is actually able to send content to it. There just seems to be some glitch in the other direction.

Perhaps that was a temporary thing? Can you test again?

I'm having the same problem on a Drupal 6 site.

I think the problem originates in MollomDrupal::getServerAuthentication() where there's a check for the function apache_request_headers(). This function only exists when PHP is installed as an Apache module, which is not always the case.

In my case we're running our site on Acquia Cloud which seems to have PHP set up in FastCGI mode.

However, there's an alternative check made in MollomDrupal::getServerAuthentication() for HTTP Basic Auth, but requests from the Mollom Content Moderation Platform doesn't seem to include the necessary headers for that.

I investigated the situation and indeed, when PHP runs as CGI, the HTTP request headers are not made available in the usual variables.

I'm relatively confident that attached patch will fix the problem.

@dixon_, can you confirm that this patch fixes this issue in your environment?

Studying this further:

1. PHP 5.4+ enables the getallheaders() function not only when running as Apache module, but also for FastCGI.
2. $_ENV does not always contain the HTTP header variables. Specifics on when exactly they're made available are hard to find.
3. If all fails, the most common workaround mentioned on the net seems to be to add the following lines to .htaccess:
   

   RewriteEngine On
   RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
   

   Alternatively the following, although it appears unnecessarily complex to me:

   RewriteEngine on
   RewriteCond %{HTTP:Authorization} ^(.*)$ [NC]
   RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
   

   These rewrite rules essentially copy $_ENV['HTTP_AUTHORIZATION'] into $_SERVER['HTTP_AUTHORIZATION'].

Attached patch slightly revises #5 to take the PHP 5.4 improvement into account.

These rewrite rules essentially copy $_ENV['HTTP_AUTHORIZATION'] into $_SERVER['HTTP_AUTHORIZATION'].

I think this statement is a bit missleading. I think what it actually does is creating (or "updating") the environment variable called HTTP_AUTHORIZATION with the value from the HTTP header Authorization. Why is this useful? Because in certain situations (like before PHP < 5.4) it's difficult to fetch the Authorization header consistently. It's more common/easier to access $_SERVER['HTTP_AUTHORIZATION'] I guess.

So, the patch itself didn't make any difference for me, in my case at least. But the problem was solved after applying the .htaccess rule you provided. Only then the headers became available in $_SERVER['HTTP_AUTHORIZATION'] and things started to work:

RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

In any case, I think the patch might be useful, so attached is a D6 version of it.

Moving forward we should probably add a note about the .htaccess rule in README.txt as well as asking hosting companies as Acquia to document this properly for their platforms that run PHP as CGI.

Thanks for reporting, reviewing, and testing! Committed to all branches.

A new development snapshot will be available within the next 12 hours. This improvement will be available in the next official release.

Additionally committed notes and instructions to both the README of the Mollom class/library as well as the README.txt of the module.

I'll also try to get in touch with Acquia Ops to ensure that this is part of their default PHP/CGI server configuration when applicable.

@sun Awesome! Thanks for quick response and commit!