Repository navigation
Pass the Authorization header to PHP-FPM; avoid the deprecated E_STRICT constant - #650
Conversation
Under PHP-FPM (and CGI) Apache doesn't hand the Authorization header to PHP,
so OAuth requests that carry their parameters in the header arrive unsigned
("requires the 'consumer_key' argument"). The rewrite rule passes it on as
HTTP_AUTHORIZATION; with mod_php it changes nothing.
E_STRICT was retired in PHP 8.0 and using the constant is deprecated since PHP 8.4.
jrmajor
left a comment
There was a problem hiding this comment.
Removing E_STRICT: PHP 8 doesn't emit E_STRICT, and all OCPL nodes run PHP 8+, so the removed check could never trigger. Every other error level is handled as before.
Forwarding Authorization: Production OCPL already passes the header to PHP. A read-only request signed only in the Authorization: OAuth header returned 200, and one with a bad signature in the header returned 401. So OAuth works the same as before. The commit needs no Apache modules or directives that .htaccess doesn't already use.
|
Thanks a lot, @jrmajor, for the review, and for checking it against production OCPL. That settles the question of whether the header is already passed through there. Next: this stays open a few more days for objections, especially from OCPL. @kojoty, @deg-pl, anyone: if you see a reason not to merge, please say so here. If there are none, I'll merge on Monday, 2026-10-19 (merge commit, so the two commits stay as tested). After that comes the next package, the regression suite ( |
PHP 7 still raises E_STRICT in a few places (mysqli, htmlentities()), and some Opencaching nodes run PHP 7.4. Dropping the check would turn those notices into exceptions there. Compare against the value 2048 instead of the constant, which is deprecated since PHP 8.4. Behaviour is now the same as before on PHP 7.4, 8.2 and 8.4.
|
A correction, after a hint from @andrixnet: OCRO, OCNL and OCUS still run PHP 7.4. My first version dropped the E_STRICT check on the assumption that PHP no longer raises it, but PHP 7 still does in a few places (mysqli, @jrmajor, sorry for the extra round: could you take another look at the second commit? Your approval was based on "PHP 8+ everywhere", which turns out not to hold. The Monday merge stays planned if that's fine with you. |
|
Sorry for misleading you, I thought that all OCPL-branch nodes are already on PHP 8. I'd add |
|
Note: OCRO, OCNL, OCUS run under mod_php |
| if ($severity != E_STRICT && $severity != E_DEPRECATED && | ||
| // 2048 = E_STRICT, still raised by PHP 7 (e.g. mysqli, htmlentities()). | ||
| // The constant itself is deprecated since PHP 8.4, so use its value. | ||
| if ($severity != 2048 && $severity != E_DEPRECATED && |
There was a problem hiding this comment.
what is 2048? (asking in the spirit of avoiding hardcoding)
There was a problem hiding this comment.
It's the literal value of E_STRICT, so it should work the same, but stop giving deprecations on PHP 8.4+.
| RewriteEngine on | ||
| # Pass Authorization header to PHP-FPM (required for OAuth) | ||
| RewriteCond %{HTTP:Authorization} .+ | ||
| RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] |
There was a problem hiding this comment.
does this affect sites running as Apache with mod_php? (ie not using php-fmp / fastcgi / etc)?
There was a problem hiding this comment.
@andrixnet: on mod_php, no effect. The rule only copies an existing Authorization header into the HTTP_AUTHORIZATION environment variable. OKAPI reads the header in OAuthUtil::get_headers() via apache_request_headers(), which under mod_php returns the real header directly; the variable from the rule isn't used there. Under PHP-FPM, Apache doesn't pass the header to PHP at all, which is what the rule fixes. I can only show this from the code; our test installations run PHP-FPM. If you can, one header-signed request (e.g. from c:geo) against OCRO after the update would confirm it.
The first of the changes from OpencachingDeutschland/okapi, cut into separate PRs (see #632). Two small fixes:
.htaccess: pass the Authorization header on to PHP. Under PHP-FPM (and CGI), Apache doesn't hand theAuthorizationheader to PHP, so OAuth requests that carry their parameters in the header arrive unsigned ("requires the 'consumer_key' argument"). The rewrite rule passes it on asHTTP_AUTHORIZATION. The condition only fires when the header is present. Not tested with mod_php; @jrmajor checked that header-signed requests behave as before on production OCPL.OkapiErrorHandler: E_STRICT without the constant. TheE_STRICTconstant is deprecated since PHP 8.4, where every comparison with it raises a deprecation notice. PHP 7 still raises E_STRICT in a few places (mysqli,htmlentities()), and some nodes run PHP 7.4, so the handler keeps ignoring it, by its value 2048. Same behaviour as before on PHP 7.4, 8.2 and 8.4 (handler checked for E_STRICT, E_DEPRECATED, E_NOTICE and E_WARNING on all three, compared with the current code on 7.4).Tested: OKAPI regression suite (read-only and writing level) against an OCDE installation and two OCPL installations (official 2018 devel dump + all updates, on MariaDB 10.11 and on MariaDB 10.0), PHP 8.2-FPM behind Apache. Without (1), every header-signed OAuth request fails there. All files pass
php -lon PHP 7.4.Merge only after a review and time for OCPL to look.