# Problem with http\_authentication + apache2 + mod\_fcgid

**URL:** <https://www.ruby-forum.com/t/problem-with-http-authentication-apache2-mod-fcgid/105114>\
**Category:** Rails\
**Created:** [May 25, 2007, 9:47pm UTC](https://www.ruby-forum.com/t/problem-with-http-authentication-apache2-mod-fcgid/105114 "2007-05-25T21:47:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\
**Post date:** [May 25, 2007, 9:47pm UTC](https://www.ruby-forum.com/t/problem-with-http-authentication-apache2-mod-fcgid/105114/1 "2007-05-25T21:47:40Z")

</div>

Hi,

I’m using the http\_authentication plugin, and everything’s working  
fine in my development environment with webrick. However, when I run  
on my production platform of apache2+mod\_fcgid,  
authenticate\_or\_request\_with\_http\_basic() always returns false, and  
(more interestingly) never processes the block. See example below.

Here’s my setup:

- apache 2.0.55
- libapache2-mod-fcgid 1.07-1
- ruby 1.8.2-1
- libfcgi-ruby1.8 0.8.6-1
- rails 1.2.3
- http\_authentication r6836 from  
[http://svn.rubyonrails.org/rails/plugins](http://svn.rubyonrails.org/rails/plugins)  
(hasn’t changed since 2006-12-02?)

For an example, in the following test code, the second debug message  
(with username and password) is never reached.

* * *

class FooController \< ApplicationController

before\_filter :test\_auth

def test\_auth  
logger.info “test\_auth: debug about to authenticate”  
authenticate\_or\_request\_with\_http\_basic do |username, pass|  
logger.info “test\_auth: debug #{username}, #{pass}”  
true  
end  
end

def index  
end

## end

When the above test code runs in webrick, all is well. Running in  
apache2 + mod\_fcgid, the following happens:

1. message appears in the log:

Processing FooController#index (for 127.0.0.1 at 2007-05-25 15:32:05)  
[GET]  
Session ID: b633470f7d331ae1603204f5b879ece3  
Parameters: {“action”=\>“index”, “controller”=\>“foo”}  
test\_auth: debug about to authenticate  
Filter chain halted as  
[#\<ActionController::Filters::ClassMethods::SymbolFilter:0xb755ac18  
@filter=:test\_auth\>] returned false.  
Completed in 0.00040 (2487 reqs/sec) | Rendering: 0.00007 (17%) | 401  
Unauthorized [[http://scmodstest/foo/index](http://scmodstest/foo/index)]

1. user is prompted by user agent (browser) for name and password.

2. message appears in the log:

Processing FooController#index (for 127.0.0.1 at 2007-05-25 15:32:12)  
[GET]  
Session ID: b633470f7d331ae1603204f5b879ece3  
Parameters: {“action”=\>“index”, “controller”=\>“foo”}  
test\_auth: debug about to authenticate  
Filter chain halted as  
[#\<ActionController::Filters::ClassMethods::SymbolFilter:0xb74aee90  
@filter=:test\_auth\>] returned false.  
Completed in 0.00036 (2816 reqs/sec) | Rendering: 0.00007 (19%) | 401  
Unauthorized [[http://scmodstest/foo/index](http://scmodstest/foo/index)]

1. lather, rinse, repeat.

Does anybody have any idea what’s going on here? Has anyone else had  
similar problems in a similar environment? How about success in a  
similar environment?

-mike

---

<div class="post-metadata">

**Author:** ![miked](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ed655f/32.png) [@miked](https://www.ruby-forum.com/u/miked)\
**Post date:** [May 25, 2007, 11:35pm UTC](https://www.ruby-forum.com/t/problem-with-http-authentication-apache2-mod-fcgid/105114/2 "2007-05-25T23:35:52Z")

</div>

OK, figured this one out. In case anyone else is interested, here’s  
the deal.

Apache does not, by default, pass authorization headers to CGI  
scripts. You can read up a bit about this at:  
[http://wiki.rubyonrails.org/rails/pages/HowtoAuthenticateWithHTTP](http://wiki.rubyonrails.org/rails/pages/HowtoAuthenticateWithHTTP)

Long story short, I had to modify the fcgid RewriteRule and make a  
small change to the http\_authentication code to allow it to recognize  
REDIRECT\_HTTP\_AUTHORIZATION. I also applied a change from the Rails  
edge version of http\_authentication.

Patch below:

# Index: public/.htaccess

— public/.htaccess (revision 819)  
+++ public/.htaccess (revision 821)  
@@ -31,7 +31,8 @@  
RewriteRule ^([^.]+)$ $1.html [QSA]  
RewriteCond %{REQUEST\_FILENAME} !-f  
#RewriteRule ^(._)$ dispatch.cgi [QSA,L]  
-RewriteRule ^(._)$ dispatch.fcgi [QSA,L]  
+#RewriteRule ^(._)$ dispatch.fcgi [QSA,L]  
+RewriteRule ^(._)$ dispatch.fcgi [E=HTTP\_AUTHORIZATION:%  
{HTTP:Authorization},QSA,L]

# In case Rails experiences terminal errors

# Instead of displaying this message you can supply a file here which

will be rendered instead

# Index: vendor/plugins/http\_authentication/lib/http\_authentication/ basic.rb

— vendor/plugins/http\_authentication/lib/http\_authentication/  
basic.rb (revision 819)  
+++ vendor/plugins/http\_authentication/lib/http\_authentication/  
basic.rb (revision 821)  
@@ -19,10 +19,10 @@  
end

```
 def authenticate(controller, &login_procedure)

```

- 

```
 if authorization(controller.request)

```

- 

```
 if authorization(controller.request).blank?

```

- 

```
   false

```

- 

```
 else

```

login\_procedure.call(\*user\_name\_and\_password(controller.request))

- 

```
 else

```

- 

```
   false
 end

```

end

@@ -32,6 +32,7 @@

```
 def authorization(request)
   request.env['HTTP_AUTHORIZATION'] ||

```

- 

```
 request.env['REDIRECT_HTTP_AUTHORIZATION'] ||
 request.env['X-HTTP_AUTHORIZATION'] ||
 request.env['X_HTTP_AUTHORIZATION']

```

end