访问API中的自定义标头

Question

I am sending a custom header to an API that I control using an AJAX call made via AngularJS.

Client (AngularJS)

var authorization_token = 'qwerty';
var custom_token_value = 'abc123';

$http.get('http://api.mywebsite.com/endpoint',{ headers:{'Auth':authorization_token,'Custom_Header':custom_token_value} }).then(function(res){ 

    console.log(res.data);

});

Server (PHP 5.6)

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET,POST,PUT,DELETE');
header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Auth, Custom_Header"); 

$headers = getallheaders();

print_r($headers);

Response

Array
(
    [Accept-Language] => en-US,en;q=0.9
    [Accept-Encoding] => gzip, deflate
    [Referer] => http://localhost:8080/
    [Auth] => qwerty
    [User-Agent] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.119 Safari/537.36
    [Origin] => http://localhost:8080
    [Accept] => application/json, text/plain, */*
    [Connection] => close
    [Host] => api.mywebsite.com
)

Why am I not able to see Custom_Header?

Answer 1

For anyone having this issue, after some trial and error I've discovered that the reason Custom_Header was not showing up is because it contained an _ (underscore) character. Underscore characters apparently get dropped from header keys.

More info here: Why underscores are forbidden in HTTP header names