php is not getting custom headers (Apache 2.4 + FPM/FastCGI php 7)

Question

I have tried to get all headers by using apache_request_headers(), $_SERVER, $_ENV and getallheaders().

I know that Apache 2.4 is dropping unknown headers for security reasons and tried to circumvent it by adding:

SetEnvIfNoCase ^X (.*) HTTP_CUSTOM=$0
RequestHeader set HTTP_CUSTOM %{HTTP_CUSTOM}e env=HTTP_CUSTOM

which successfully catches/renames known headers, but when trying to catch an X-Custom-Header, it is always empty.

What could be the cause?

Scend

What returns the command : apache2ctl -V ? Have you tested it with add or merge ? RequestHeader add HTTP_CUSTOM %{HTTP_CUSTOM}e env=HTTP_CUSTOM – Assurgent

@Scend did my answer work? – Watterson

Answer 1

So I'm not actually sure what you are trying to do.

If you are trying to add headers that start with X from your request to your response then I would use this in your htaccess file.

Header echo ^X

If you are trying to use header values in your PHP script then they should be in your $_SERVER array, but the names are normalized. E.G

X-Custom-Header: blah
X-Na-Bra: true

can be accessed from

<?php 
   // note that headers are prefixed with "HTTP" and "-" and changed to "_"
   echo $_SERVER['HTTP_X_CUSTOM_HEADER'];
   echo $_SERVER['HTTP_X_NA_BRA'];

  // either way you should be able to find them with a print_r($_SERVER);
  // print_r(getallheaders()); should show the headers without normalized names
  $tempArray = getallheaders();
  echo $tempArray['X-Custom-Header'];
?>

It sounds like you want to get the values from a dynamic number of headers that start with X. If this is the case then your code won't work either way. Your code (if it worked) would always contain the last value of a header that starts with X. So if you have more than 1 header that starts with X then you would be missing values. Using your code, you would need to create a rule for each header that you wanted to pass to your PHP script, which sounds like a pain.

If i'm missing something then comment below and I'll update this answer.

Watterson