Apache removes Authorization header

Question

Apache is acting as a reverse proxy in my setup. The application server running on port 8081 requires a valid Authorization header. The header is set by the client application. Apache seems to remove this header. It does not reach the server on port 8081.

<VirtualHost mydomain.com:443>
    ServerName mydomain.com
    ServerAlias www.mydomain.com

    <Proxy *>
            Order deny,allow
            Allow from all
    </Proxy>

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/apache.pem

    ProxyPreserveHost On
    ProxyRequests Off
    ProxyPass / http://mydomain.com:8081/
    ProxyPassReverse / http://mydomain.com:8081/
</VirtualHost>

To verify the server on port 8081 is working correctly, I added RequestHeader set Authorization "Basic XZY" to that configuration. In this case, the header is processed correctly by the server on port 8081.

I also connected to the server on port 8081 directly from the client to make sure the client is really setting the correct header. That also worked well.

Answer 1

From the mod_proxy_http docs:

proxy-chain-auth:

If the proxy requires authentication, it will read and consume the proxy authentication credentials sent by the client. With proxy-chain-auth it will also forward the credentials to the next proxy in the chain. This may be necessary if you have a chain of proxies that share authentication information. Security Warning: Do not set this unless you know you need it, as it forwards sensitive information!

Is this what you are looking for?

Answer 2

It turned out the the reason was a buggy client implementation.