I'm developing a web application that interacts with a GraphQL instance on another server (not mine). The GraphQL instance requires me to send an authorization header ("Bearer [token]"). The responses I'm getting from GraphQL seem to indicate that the authorization header is not being received (or, less likely, is being altered in some way before receipt).
I have verified that the authorization header itself works correctly when sent via https://reqbin.com/curl.
In looking for answers, I came across several cases similar to mine. Some suggested additions to my .htaccess file—I tried these with no effect. Other cases indicated an issue with my $_SERVER['HTTP_AUTHORIZATION'] setting and/or the settings viewable through apache_request_headers().
Both of these values are empty. I've verified the $_SERVER['HTTP_AUTHORIZATION'] in my phpinfo file is set to 'no value', and there is no entry at all for $_SERVER['REDIRECT_HTTP_AUTHORIZATION'].
To be honest, I don't really know what any of this means. I'm barely competent in modifying Googled PHP scripts for my own use. But I have verified through reqbin that the information I'm sending is correct, and that the same information sent from my own server gets a response indicating a bad/mission authorization header.
Is it possible that the 'no value' setting for my $_SERVER['HTTP_AUTHORIZATION'], and the matching lack of an authorization key in apache_request_headers() is the issue? Would that prevent me from sending authorization headers, or alter them in some way before sending? If it matters, here's the code I'm using to send the headers:
$header_auth = 'Bearer ' . $access_token;
$body = array(
'query'=>'some request'
);
$body_json = wp_json_encode($body);
$info_response = wp_remote_post('https://somewebsite.com/api/graphql/v1/',array(
'headers' => array(
'Authorization' => $header_auth,
'Content-Type' => 'application/json'
),
'body' => $body_json
));