request.META does not contain header passed from curl -H

Question

"It works on my machine."

I have a django app. I'm followed this tutorial. OAuth2 works great on my dev box like this:

$ curl -v -H "Authorization: OAuth c52676b24a63b79a564b4ed38db3ac5439e51d47" http://localhost:8000/api/v1/my-model/?format=json

My local dev app finds the header with this line of code:

auth_header_value = request.META.get('HTTP_AUTHORIZATION')

But when I deploy it to my ubuntu box running apache it doesn't.

I added the following to my authentication.py file so I could inspect the values in the log on the remote machine.

logging.error(request.GET)
logging.error(request.POST)
logging.error(request.META)

The header value is mysteriously missing from the output. So I just get 401s.

Answer 1

Did you turn on WSGIPassAuthorization?

http://modwsgi.readthedocs.org/en/latest/configuration-directives/WSGIPassAuthorization.html

Authorisation headers are not passed through by default as doing so could leak information about passwords through to a WSGI application which should not be able to see them when Apache is performing authorisation.