# iCal / Authentication / Site5?

**URL:** <https://www.ruby-forum.com/t/ical-authentication-site5/59492>\
**Category:** Rails\
**Created:** [May 3, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/ical-authentication-site5/59492 "2006-05-03T19:09:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_on\_Rails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df705f/32.png) [@Josh\_on\_Rails](https://www.ruby-forum.com/u/Josh_on_Rails)\
**Post date:** [May 3, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/ical-authentication-site5/59492/1 "2006-05-03T19:09:40Z")

</div>

So, I’m working on adding iCal support to my app. Since I want to  
restrict  
users to their own calendars, form-based authentication isn’t going to  
work,  
so I’m using the Basic HTTP Authorization from this page -  
[http://blogs.23.nu/c0re/stories/7409/](http://blogs.23.nu/c0re/stories/7409/)

Everything works fine in my dev machine, but on the server (Site5), I  
get  
the login prompt ad infinitum.

Has anyone run into this? Have other suggestions I could try?

Chasing down another theory, I noticed that “HTTP\_AUTHORIZATION” doesn’t  
appear in request.en – is it possible/likely that’s the source of my  
problem?

Thanks!

---

<div class="post-metadata">

**Author:** ![Josh\_on\_Rails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df705f/32.png) [@Josh\_on\_Rails](https://www.ruby-forum.com/u/Josh_on_Rails)\
**Post date:** [May 3, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/ical-authentication-site5/59492/2 "2006-05-03T19:09:53Z")

</div>

It looks like this is the issue:

[http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticateWithHTTP](http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticateWithHTTP)

> If you are using Apache and mod\_fastcgi, this method will likely not work  
> out of the box. Apache does not allow CGI scripts access to HTTP  
> authorization headers by default. You will need to configure FastCGI to pass  
> the Authorization header to your scripts [http://www.fastcgi.com/mod\_fastcgi/docs/mod\_fastcgi.html#FastCgiServer](http://www.fastcgi.com/mod_fastcgi/docs/mod_fastcgi.html#FastCgiServer) .  
> Short version: add |-pass-header Authorization| to the FastCgiServer startup  
> directive, or |FastCgiConfig -pass-header Authorization|, for Apache 2, or  
> |-pass-header HTTP\_AUTHORIZATION| for Apache 1. For this, you will need  
> access to apache’s config file.

I’ve tried the suggested modification to htaccess (eg,  
E=X-HTTP\_AUTHORIZATION:%{HTTP:Authorization}), but I get an odd  
request.env:

“REDIRECT\_X\_HTTP\_AUTHORIZATION”=\>“”

---

<div class="post-metadata">

**Author:** ![Josh\_on\_Rails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/df705f/32.png) [@Josh\_on\_Rails](https://www.ruby-forum.com/u/Josh_on_Rails)\
**Post date:** [May 3, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/ical-authentication-site5/59492/3 "2006-05-03T19:09:55Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

Hi Josh,

> Everything works fine in my dev machine, but on the server (Site5),  
> I get the login prompt ad infinitum.
> 
> Has anyone run into this? Have other suggestions I could try?
> 
> Chasing down another theory, I noticed that “HTTP\_AUTHORIZATION”  
> doesn’t appear in request.en – is it possible/likely that’s the  
> source of my problem?

When writing CGI’s I’ve fixed the problem with two approaches. I’m not  
entirely sure it will work with FastCGI, but its worth a try.

The first approach is to recompile Apache and tell it to set the  
HTTP\_AUTHORIZATION environment variable when possible:

[http://httpd.apache.org/dev/apidoc/](http://httpd.apache.org/dev/apidoc/)  
apidoc\_SECURITY\_HOLE\_PASS\_AUTHORIZATION.html

The second approach is similar to the one you tried. I simply add the  
following three lines into the .htaccess, or in the httpd.conf inside  
a or tag:

RewriteEngine On  
RewriteCond %{HTTP:Authorization} (._) [NC]  
RewriteRule ._ - [E=HTTP\_AUTHORIZATION:%1]

* * *

Thanks,

Dan

* * *

Dan K.  
Autopilot Marketing Inc.

Email: removed\_email\_address@domain.invalid  
Phone: 1 (604) 820-0212  
Web: [http://autopilotmarketing.com/](http://autopilotmarketing.com/)  
vCard: [http://autopilotmarketing.com/~dan.kubb/vcard](http://autopilotmarketing.com/~dan.kubb/vcard)

* * *

-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.2.2 (Darwin)

iD8DBQFEU+ne4DfZD7OEWk0RAp+FAJ4jYejbJDpyFvtfbxOGRZQaJYPQYQCcCNB3  
Nlgf6K24Rq8zqZNmoSbEOyY=  
=Kxi1  
-----END PGP SIGNATURE-----