I've run into a problem using the Shield module in certain hosting environments (namely Webfaction) because their setup doesn't pass on environment variables in the HTTP header. The result is that Shield keeps the webserver stuck in an endless loop asking for login credentials because it never gets values of username and password.

Here's the explanation taken from their forum:

The common workarounds for that problem involve setting a HTTP_AUTHENTICATION environment variable via mod_rewrite, but that doesn't work on our servers because our php-cgi environment runs on Apache with suExec, which does not pass environment variables to CGI scripts.
So, the solution is the pass the HTTP:Authentication header to your PHP script via some other means.

They suggest using mod_rewrite to pass the username and password variables as URL parameters. I don't know if this issue is really a bug per se but I thought I'd document my experience; maybe there's room for changes in Shield to work across more hosting configurations.

Thoughts?

Comments

cossovich’s picture

I've lodged a companion issue against Drupal core here: #2078699: htaccess rewrite rules for HTTP authentication are not compatible with certain hosting environments

To implement the solution suggested by Webfaction the htaccess file in the Drupal root would need to be modified.

cossovich’s picture

Here's my patch to implement the workaround outlined in the Webfaction docs.

geek-merlin’s picture

Issue summary: View changes
Parent issue: » #2786369: Plan for a 7.x-1.3 release

Sounds reasonable.

This would need a link to above issue in the readme and/or project page too.

  • axel.rutz committed ce4db6e on 7.x-1.x authored by cossovich
    Issue #2078697 by cossovich: Certain PHP CGI hosting configurations don'...
geek-merlin’s picture

Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.