The request object handles auth headers incorrectly

[sergeyklay]

Expected and Actual Behavior

I would like to see correct Authorization Headers in case of use such types of authorization:

• Basic
• Digest
• Bearer

Minimal script to reproduce the issue:

Setup

$di = new Phalcon\Di();

$di->set('filter', function () {
    return new Phalcon\Filter();
});

$request = new Phalcon\Http\Request();
$request->setDI($di);

Test 1

$_SERVER = [
    'PHP_AUTH_USER' => 'phalcon',
    'PHP_AUTH_PW'   => 'secret',
];

print_r($request->getHeaders());

Actual

Array
(
)

Expected

Array
(
    [Php-Auth-User] => phalcon
    [Php-Auth-Pw] => secret
    [Authorization] => Basic cGhhbGNvbjpzZWNyZXQ=
)

Test 2

$_SERVER = [
    'HTTP_AUTHORIZATION' => 'Basic cGhhbGNvbjpzZWNyZXQ=',
];

print_r($request->getHeaders());

Actual

Array
(
    [Authorization] => Basic cGhhbGNvbjpzZWNyZXQ=
)

Expected

Array
(
    [Authorization] => Basic cGhhbGNvbjpzZWNyZXQ=
    [Php-Auth-Pw] => secret
    [Php-Auth-User] => phalcon
)

Test 3

$auth = [
    'username="admin"',
    'realm="The batcave"',
    'nonce=49938e61ccaa4',
    'uri="/"',
    'response="98ccab4542f284c00a79b5957baaff23"',
    'opaque="d8ea7aa61a1693024c4cc3a516f49b3c"',
    'qop=auth',
    'nc=00000001',
    'cnonce="8d1b34edb475994b"'
];

$_SERVER = [
    'REDIRECT_HTTP_AUTHORIZATION' => 'Digest ' . implode(', ', $auth),
];

print_r($request->getHeaders());

Actual

Array
(
)

Expected

Array
(
    [Php-Auth-Digest] => Digest username="admin", realm="The batcave", nonce=49938e61ccaa4, uri="/", response="98ccab4542f284c00a79b5957baaff23", opaque="d8ea7aa61a1693024c4cc3a516f49b3c", qop=auth, nc=00000001, cnonce="8d1b34edb475994b"
    [Authorization] => Digest username="admin", realm="The batcave", nonce=49938e61ccaa4, uri="/", response="98ccab4542f284c00a79b5957baaff23", opaque="d8ea7aa61a1693024c4cc3a516f49b3c", qop=auth, nc=00000001, cnonce="8d1b34edb475994b"
)

Test 4

$accessToken = 'some-secret-token-here';

$_SERVER = [
    'HTTP_AUTHORIZATION' => "Bearer {$accessToken}",
];

print_r($request->getHeaders());

Actual

Array
(
)

Expected

Array
(
    [Authorization] => Bearer some-secret-token-here
)

And yes, as described in RFC 7230 - "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing", Section 3.2, "Header Fields":

Each header field consists of a case-insensitive field name followed by a colon (":"), optional leading whitespace, the field value, and optional trailing whitespace.

we can safely return either Php-Auth-User, or PHP-AUTH-USER, or php-auth-user.

Details

• Phalcon version: 3.0.2
• PHP Version: 7.0.13
• Operating System: Ubuntu 14.04.5 LTS
• Installation type: Compiling from source
• Zephir version (if any): 0.9.5a-dev
• Server: Nginx | Apache

[sergeyklay]

Fixed in the 3.0.x branch.

[quickshiftin]

I'm still encountering this issue in 3.3.1. Essentially $phalconRequest->getAllHeaders() is getallheaders() minus the Authorization header.

[sergeyklay]

@quickshiftin Did you see tests at tests/unit/Http/Request/AuthHeaderTest.php

[quickshiftin]

@sergeyklay I'm looking at it now, and your patch from 3.0.x. It looks like Phalcon does some introspection of the Authorization header's value, and I suspect that's where it's breaking down in my case.

I'm using JWT, so my Authorization headers look like

Authorization: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1MzAxMDY3MjQsImlzcyI6InNlbGxlcnZ1ZS1qd3QtYXV0aCIsImlkIjo0LCJsb2dpbiI6InF1aWNrc2hpZnRpbkBnbWFpbC5jb20iLCJpYXQiOjE1MzAwMjAzMjQsInVzZXIiOnsiaWQiOjQsImxvZ2luIjoicXVpY2tzaGlmdGluQGdtYWlsLmNvbSIsImZpcnN0X25hbWUiOiJOYXRlIiwibGFzdF9uYW1lIjoiTm9iYmUiLCJwYXNzd29yZCI6IjE5NzY4MTA5YzIyNzVlMTg4NTYyNWMzNWMzZTNiNDNiZTk2ZTYzMmI3OWQ4OThjYjU1ZjJkM2VkMTQ1YzQyMDYiLCJ0bXBfcGFzcyI6bnVsbCwiaXNfYWN0aXZlIjp0cnVlLCJpc19hZG1pbiI6dHJ1ZSwidG1wX3Bhc3NfZXhwIjpudWxsLCJhd3NfYWNjZXNzX2tleSI6IiIsImF3c19zZWNyZXRfa2V5IjoiIiwiYXBwX25hbWUiOiIiLCJtZXJjaGFudF9pZCI6IiIsImFwaV9tYXJrZXRwbGFjZV9pZCI6Mn19.gxeBcYXfarytnysL2hFB76UWKbfy0d3G-cy1H6bqBtajiHHN__gGR1ZyofLtlW7MWHo5Wt_nanIJ_96-ZxLkZiPoiPc6bFPIAhDvFszmbN8lv-LKp-V4IANrh4v-DqEN0x9J23DftlMhm5Y9F4ablPTdHpN9LB-LyIJQi-2LFZMDMeaLQStIIKIJkOoO9vzSXx3my5T-qz8xPTfWRC25tuL8xsbj_J-GthXIwn-9xYfFVE_ahXCc3nisxi6XVY3dLZ045OttpL8dn0Lu_M0Bwq6wuY73hFZgxOk_HNwjrCIB4WlwGqg9qOhr-Oe70hMR5suS_h8Oep16LQBufTZ230-r9p4uEjpfhfwH01BzSKyxVYyGx-EQNuu9cqIfVWNfMpNc53lPhtVOKIg-2MbBkJgyLSSqqINUmq8lhW2GvHCeHpR_hDOgpH3fjXFWCuJtxY207_xkLR5qxWAY6fGZeVJFiUyU7b-JLq1R4H1Vai4scEyKqLub6Z_GRnizEjIQi0eoqoMPat3vhSiGd2zMyT3b54xgdBiPfpPErHeO3ee9b6nTvQ_9I_5oOcif7SGM2BiNyTq64Or3V3Yhdr8sEQVwafi4kxJD7eghSLWxy-3WAOvND4Q8R555cHZZvYnwiQePsFNub_04KNwq_Ve2oEPWeI4QiPH8aXdiObjP1ow

I see some logic in there to handle bearer, but it's not working. Maybe if I find time one of these days I'll run the unit tests against my headers and figure out what's wrong.