Changeset 47239 for trunk/src/wp-includes/rest-api/class-wp-rest-server.php

Timestamp:

02/10/2020 04:06:58 PM (5 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Add support for the REDIRECT_HTTP_AUTHORIZATION header.

Previously the REST API did not account for server configurations where the Authorization header must be added using ModRewrite. This caused major DUX issues when trying to use custom authentication mechanisms.

Fixes #47077.
Props dshanske, cklosows.

File:

• trunk/src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -1381 +1381 @@
             if ( strpos( $key, 'HTTP_' ) === 0 ) {
                 $headers[ substr( $key, 5 ) ] = $value;
+            } elseif ( 'REDIRECT_HTTP_AUTHORIZATION' === $key && empty( $server['HTTP_AUTHORIZATION'] ) ) {
+                /*
+                 * In some server configurations, the authorization header is passed in this alternate location.
+                 * Since it would not be passed in in both places we do not check for both headers and resolve.
+                 */
+                $headers['AUTHORIZATION'] = $value;
             } elseif ( isset( $additional[ $key ] ) ) {
                 $headers[ $key ] = $value;