Symfony2 - prod模式下的身份验证失败

Question

I have a big problem with my Symfony2 application. I have created a RestFul Api with FosRestBundle, FosUserBundle and LexikJWTAuthenticationBundle. On my computer, no problem, authentication works well. But when I upload the whole app on OVH shared server (perf1), the development environment still work but not the prod one. It says Bad credentials ... I use Postman to try.

My security.yml is the following :

security:
encoders:
    FOS\UserBundle\Model\UserInterface: 
        algorithm:            pbkdf2
        hash_algorithm:       sha512
        encode_as_base64:     true
        iterations:           1000

role_hierarchy:
    ROLE_ADMIN:       ROLE_USER
    ROLE_SUPER_ADMIN: ROLE_ADMIN

providers:
    fos_userbundle:
        id: fos_user.user_provider.username_email

firewalls:
    login:
        pattern:  ^/auth/login
        stateless: true
        anonymous: true
        form_login:
            provider: fos_userbundle
            check_path:               /auth/login
            success_handler:          lexik_jwt_authentication.handler.authentication_success
            failure_handler:          lexik_jwt_authentication.handler.authentication_failure
            require_previous_session: false
            username_parameter: username
            password_parameter: password
            post_only:      true

    api_open:
        pattern: ^/api/open
        anonymous:    true
        stateless: true
        lexik_jwt: ~

    api_secured:
        pattern: ^/api
        anonymous:    false
        stateless: true
        lexik_jwt: ~

access_control:

I have cleared and warmup the prod cache.

Do you have an idea from where it could come from ?

Thank you.

Answer 1

This is because apache is striping out your Authorization header from your request. My workaround is to add this in your .htaccess in your web folder or anywhere apache could load it :

<IfModule mod_rewrite.c>
    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
</IfModule>

/!\ Don't forget to activate url rewrite in apache (google it if you dont know what i mean)