Hide the Authorization Header in PHP-FPM

Question

I need to make Apache's mod_auth_basic opaque to PHP-FPM so that I can run scripts that get confused by Authorization headers. I've tried a variety of CGI and Header directives and so far am unable to hide the headers from PHP.

Specifically, with AuthType Basic the PHP-FPM environment is always including these values:

$_SERVER['AUTH_TYPE']
$_SERVER['HTTP_AUTHORIZATION']
$_SERVER['PHP_AUTH_USER']
$_SERVER['PHP_AUTH_PW']
$_SERVER['REMOTE_USER']

I'm using Apache 2.4 and PHP8.3-FPM in Ubuntu 20.04.6.

The last resort would be adding a proxy server, but I'm hoping for a simpler solution.

Answer 1

After hours of digging through Apache docs, I found this one:

ProxyFCGISetEnvIf Directive

And here's what worked for me to make AuthType Basic completely opaque:

<FilesMatch \.php$>
    SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    ProxyFCGISetEnvIf true !AUTH_TYPE
    ProxyFCGISetEnvIf true !HTTP_AUTHORIZATION
    ProxyFCGISetEnvIf true !REMOTE_USER
</FilesMatch>