Wednesday, October 10, 2012

Rack::Auth::Basic with Apache and mod_fcgid

I recently struggled to find the answer, but I've finally got a working configuration and wanted to share it. I was using Rack::Auth::Basic for a project that I didn't need a full blown authentication system, but just to keep the site from being totally public. I had my rackup server using it just fine, but trying to run it through Apache and mod_fcgid was not working. My breakthrough came after a long time of scouring over the Internet finding the following post (finder's credit to my brother who helped me debug the issue): https://metacpan.org/module/Plack::Middleware::Auth::Basic#LIMITATIONS This idea and a few Apache docs later we came up with the following configuration:
<Directory /www/site>
  Options +ExecCGI +FollowSymLinks
  AllowOverride None
  RewriteEngine On
  # Make sure HTTP_AUTHORIZATION has something in it before trying to hand it over!
  RewriteCond %{HTTP:Authorization} ^(.+)$
  # Add HTTP_AUTHORIZATION to the environment so our rack app can get at it.
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ dispatch.fcgi [QSA,L]
</Directory>
The first RewriteRule is used because of this:
Flags that alter metadata associated with the request (T=, H=, E=) have no affect in per-directory and htaccess context, when a substitution (other than '-') is performed during the same round of rewrite processing.
Tested Versions:
Rack      1.4.0, 1.4.1
Apache    2.2.6, 2.2.15 
mod_fcgid 2.3.5, 2.3.7
Side note:
When testing something like this, your browser likes to cache the username and password, which is really nice for actual use, but if you're trying to get it working, and you've possibly got cached values, change your password in your app. It will cause authentication with the cached values to fail and require you to enter new credentials.

4 comments:

Anonymous said...

bet365 - THAKE Casino
bet365 is one 1xbet korean of the ボンズ カジノ leading online casino and betting sites in bet365 Malaysia. The most trusted online casino in Malaysia. Established in 2001, bet365 is a member of

Unknown said...

1xbet - No 1xbet Casino | Live dealer casino online
1xbet is a https://vannienailor4166blog.blogspot.com/ reliable https://deccasino.com/review/merit-casino/ casino site that offers a great casino games from the best 1xbet korean software providers for the regulated gambling markets. Rating: 8/10 · ‎Review by microtouch solo titanium a wooricasinos.info Tripadvisor user · ‎Free · ‎Sports

walwynuberti said...

The on-line casino is completely net primarily 토토사이트 based, so simply go to our website from your pre-ferred gadget, login, and start playing in}. Users who wish to have a great time on their smartphones get an extra advantage from playing in} on Fairspin. You will be able to|be succesful of|have the flexibility to} log in, make a deposit and even get a nice bonus right from your cell gadget.

Anonymous said...

By deciding on an web on line casino with a great popularity, punters can keep away from potential risks and losses. However, a gaming platform all the time takes a sure share of money deposited by punters . People who're new to the business of iGaming 토토사이트 ought to know the fundamentals to have a great start with out facing any issues. Today, we wish to offer a transparent guide for all newcomers to Internet casinos.