1

I'm developing a web application that interacts with a GraphQL instance on another server (not mine). The GraphQL instance requires me to send an authorization header ("Bearer [token]"). The responses I'm getting from GraphQL seem to indicate that the authorization header is not being received (or, less likely, is being altered in some way before receipt).

I have verified that the authorization header itself works correctly when sent via https://reqbin.com/curl.

In looking for answers, I came across several cases similar to mine. Some suggested additions to my .htaccess file—I tried these with no effect. Other cases indicated an issue with my $_SERVER['HTTP_AUTHORIZATION'] setting and/or the settings viewable through apache_request_headers().

Both of these values are empty. I've verified the $_SERVER['HTTP_AUTHORIZATION'] in my phpinfo file is set to 'no value', and there is no entry at all for $_SERVER['REDIRECT_HTTP_AUTHORIZATION'].

To be honest, I don't really know what any of this means. I'm barely competent in modifying Googled PHP scripts for my own use. But I have verified through reqbin that the information I'm sending is correct, and that the same information sent from my own server gets a response indicating a bad/mission authorization header.

Is it possible that the 'no value' setting for my $_SERVER['HTTP_AUTHORIZATION'], and the matching lack of an authorization key in apache_request_headers() is the issue? Would that prevent me from sending authorization headers, or alter them in some way before sending? If it matters, here's the code I'm using to send the headers:

$header_auth = 'Bearer ' . $access_token;
$body = array(
  'query'=>'some request'
);
$body_json = wp_json_encode($body);
$info_response = wp_remote_post('https://somewebsite.com/api/graphql/v1/',array(
  'headers' => array(
    'Authorization' => $header_auth,
    'Content-Type' => 'application/json'
  ),
  'body' => $body_json
));
Improve this question
7
  • 1
    .htaccess and phpinfo are for your own server and shouldn't effect the headers sent by your code snippet.
    – Stephen Ostermiller ♦
    Dec 7 '20 at 23:24
  • 1
    @stephenOstermiller I wonder if .htaccess is being used to add custom headers with the required tokens so the script can access this auth stuff. (I can't say that would be great design, but it could explain the comments about .htaccess and $_SERVER. Of-course, if this is the case it probably requires something like mod_header which may not exist)
    – davidgo
    Dec 8 '20 at 3:02
  • 1
    More info - search for HTTP_AUTHORIZATION at github.com/wp-graphql/wp-graphql-jwt-authentication
    – davidgo
    Dec 8 '20 at 3:06
  • 2
    When you send the authorization header via CURL, what format is it in? Where is $access_token set? I posit your problem does not lie in .htaccess or $_SERVER, rather in the $header_auth setting or more likely your headers array.
    – davidgo
    Dec 8 '20 at 3:14
  • 1
    @EyeTeeth if DavidGo doesn't add an answer for you to accept, you should answer your own question for future visitors
    – Steve
    Dec 8 '20 at 22:30
1

With thanks to @Stephen Ostermiller and @davidgo, .htaccess and $_SERVER variables are not for outgoing queries. If there is a question of what exactly is being sent in your outgoing queries, change your endpoint to https://httpbin.org/anything, which will return all of the headers and contents of your query.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.