The code in mod_rewrite_rules() to write to .htaccess is wrong.

[nendeb55]

Code in the rewrite_rules function

<?php
$rules .= 'RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]';

1.There are no newlines, so the next line comes after it.
1.The .* - in is not ^(.*) - in RewriteRule.

[johnbillion]

Thanks for the report.

This change was introduced in [49109] / #42790. @georgestephanis @timothyblynjacobs can you take a look?

[georgestephanis]

Thanks for the report! I'll get a pr/patch together this afternoon/evening. Kid wrangling solo atm. :)

I didn't add the suggested parentheses, as I don't believe they are necessary to do the regex capture, and the prior working art for this seemed to run perfectly without them -- ​https://github.com/WordPress/application-passwords/wiki/Basic-Authorization-Header----Missing

Trac ticket: https://core.trac.wordpress.org/ticket/51495

[georgestephanis]

updated the pr after a minor oops in the first pass, should be a-ok now. :)

I skipped the parentheses as noted in the PR as we're not using them for capture so they shouldn't be needed here.

[SergeyBiryukov]

In 49131:

Rewrite Rules: Add missing newline to the HTTP_AUTHORIZATION rewrite rule.

Follow-up to [49109].

Props nendeb55, georgestephanis, johnbillion.
Fixes #51495. See #42790.

Merged in 405a561.