2

I'm trying to pass headers from php code back to the apache accesslog by using HTTP headers, like so:

Header note X-Userid userid
Header unset X-Userid

LogFormat "%h %l %{userid}n %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_php_userid
CustomLog /var/log/apache2/access_log combined_with_php_userid

With mod_php, the userid is inserted into the log as expected, and the header is unset before being sent to the client.

When running via php-fpm, using the following line, the userid is not inserted in the log and is not unset in the client HTTP headers.

ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9001/var/html/$1

Originally I was using apache_note but this is only available with mod_php. I found the above as a solution for passing data from PHP to Apache/php-fpm or nginx, but it doesn't seem to work with php-fpm.

Is there something I need to enable or set to get Header unset working under php-fpm?

Virtual Host Config:

<VirtualHost *:80>
    ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9001/web/ee2/sites/site.com/$1
    ServerAdmin [email protected]
    DocumentRoot /web/ee2/sites/site.com
    ServerName site.dev

    Header note X-Userid userid
    Header unset X-Userid

    ErrorLog  /var/log/apache2/site.dev-error_log
    LogFormat "%h %l %{userid}n %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_php_userid
    # also tried: # LogFormat "%h %l %{X-Userid}i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_php_userid
    CustomLog /var/log/apache2/searchenginenews.com-access_log combined_with_php_userid

    <Directory /web/ee2/sites/site.com>
        AllowOverride All
        Require all granted
    </Directory>

</VirtualHost>
Improve this question
1

3 Answers 3

Reset to default
4

mod_proxy_fcgi adds response headers to r->err_headers_out which means you should use at least:

Header unset X-Userid always

But there is no reason to not use both:

Header always unset X-Userid
Header unset X-Userid

This is an unfortunate part of the Apache API that bleeds into mod_headers -- headers can live in two places depending if they're meant to persist for non-success responses.

Improve this answer
4
  • Thanks for the reply. Indeed, Header always unset X-Userid removes it from the response. Note that Header unset X-Userid always (with always at the end) results in a config error on restart. While the above did work, I'm still unable to note the value for use in the log as %{userid}n, nor am I able to pull it from the headers with %{X-Userid}i, which the docs state I should be able to do.
    – Ian
    Dec 3, 2014 at 20:02
  • %{X-Userid}i would be a request header (i-as-in-input). I would need to test-drive the note issue separately -- not sure what's going on there.
    – covener
    Dec 3, 2014 at 20:08
  • Aha, I am able to use %{X-Userid}o (I mixed up the i and the o) but only if I don't unset the header... and I'd prefer for the userid to not leak out in the headers. I'll continue poking away at this..
    – Ian
    Dec 3, 2014 at 20:08
  • makes sense that it would not be loggable if unset -- copying to a note makes sense there (despite not working)
    – covener
    Dec 3, 2014 at 20:09
2

From troubleshooting in the comments, I think this is a bug - the headers coming back from mod_proxy_fcgi seem to be unavailable to mod_headers in any way, and are being combined with the data from mod_headers after it processes.

For now, if you need this behavior to work correct, maybe look at nginx or lighttpd, or slapping an HAProxy or Varnish instance in front of Apache to do the logging and header manipulation in the right way?

Improve this answer
12
  • The header I set is visible to the client (ie, it is not Header unset). I'm using Header note X-Userid userid because that is what works with mod_php, and is specified in the instructions I've followed elsewhere. What should I use instead record the X-Userid header as an apache note for the log? If not a note, then what?
    – Ian
    Nov 24, 2014 at 23:20
  • @Ian Oh, got it, the logging is from the header module and not the apache_note(), that's what threw me off. Sorry about that! Ok, so, to test, let's do a simple Header set test test, the try fetching both a proxied PHP file and something static that's served without going to FastCGI, to see if the header is added correctly. I'm wondering if mod_headers isn't acting at all on the FastCGI responses, as this bug report seems to indicate: bugs.launchpad.net/ubuntu/+source/libapache-mod-fastcgi/+bug/…
    – Shane Madden
    Nov 24, 2014 at 23:33
  • confirmed that Header set test test works with php-fpm. I see the header delivered to the client.
    – Ian
    Nov 24, 2014 at 23:37
  • also confirmed that Header unset test prevents the test header.
    – Ian
    Nov 24, 2014 at 23:41
  • @Ian And the client's getting X-Userid as well in the same response, right? That's incredibly strange.. How about if we Header set X-Userid test, does that overwrite it?
    – Shane Madden
    Nov 24, 2014 at 23:41
1

This question is old, but may help someone looking for its final solution:

As covener pointed out with Header unset you should also set the condition 'always' when setting the note:

Header always note X-Userid userid
Header always unset X-Userid

Use %{userid}n as placeholder for the variable (n from 'internal note' that is were mod_headers saves the value of the variable.

From the docs:

Header [condition] note header value

The optional condition argument determines which internal table 
of responses headers this directive will operate against. Despite the 
name, the default value of onsuccess does not limit an action to 
responses with a 2xx status code. Headers set under this condition are 
still used when, for example, a request is successfully proxied or 
generated by CGI, even when they have generated a failing status code.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .