Admin Tools

#38565 htaccess restricts access to web service api

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

4.2.8

PHP version

8.1

Admin Tools version

7.2.0

Latest post by nicholas on Friday, 17 February 2023 02:54 CST

Thursday, 16 February 2023 12:56 CST

carcam

Hi,

I'm adding access to Joomla Web Service API to a project using user Token, but when I try to access, it seems that htaccess generated by Admin Tools is blocking my request.

This is the kind of request I'm doing:

curl --request GET \
--url https://mydomain.com/index.php/v1/bwc/calls/1/levels\?filter[level]=1 \
--header 'Authorization: Bearer JSONTOKEN' \
--header 'content-type: application/json'

Funny thing is that I started allowing public requests to the endpoint and it worked fine, but after setting it with proper permissions and adding the JSON token, it no longer works.

If I use Joomla default htaccess, the webservice endpoint works without issues.

Where should I look?

Friday, 17 February 2023 02:39 CST

nicholas

For now send the header

X-Joomla-Token: YOUR_TOKEN_HERE

instead of

Authorization: Bearer YOUR_TOKEN_HERE

It will work just fine.

I am already looking into it because I ran into it a couple of days ago. I just didn't have the time because of the Joomla security release.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 17 February 2023 02:54 CST

nicholas

Add the following to the rules to add at the top of the file in the .htaccess Maker configuration:

# PHP FastCGI fix for HTTP Authorization
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

Now the Authorization header will work. That's actually a problem with the PHP-CGI/PHP-FastCGI/PHP-FPM binary. While the .htaccess Maker adds this line, it adds it towards the bottom of the file instead of at the top, hence the API authentication problem.