New api tokens not working?

[tofuSCHNITZEL]

I tried to switch my scripts to the new bearer tokens and I followed the API examples but I always get:

  Client error: `POST http://kimai.test/api/customers` resulted in a `401 Unauthorized` response:
  {"code":401,"message":"Full authentication is required to access this resource."}

I even copied the code from the API example 1:1 and just inserted my token but I still get the "Full authentication required" error

What am I missing here? the "KIMAI_API_TOKEN" should just be the token displayed once when creating it, right?

[kevinpapst]

Please share what not works. This does:

curl -X "POST" "https://127.0.0.1:8016/api/projects" \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer 2dc9b3d77b7641c955d911c8c' \
     -d $'{
  "start": "2023-02-07T11:02:25",
  "customer": 6,
  "comment": "sdfsdf",
  "name": "API project",
  "visible": true
}'

[tofuSCHNITZEL]

okay interesting... I only get Undefined array key "HTTP_AUTHORIZATION"

then I added:
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
(ref: https://www.wp-pay.org/http-authorization-header-missing/)
to the .htaccess file and now everything is working.

so it seems something in all of my different installations is stripping the authorization header away

I also added this to the htaccess on my plesk/apache/nginx server and now it works there as well...
And for IIS it seems to just work without any additional tricks.

[kevinpapst]

Weird that Apache strips it, never heard of that before.

I guess I should add that to the documentation pages, as very likely more people will show up with that issue.

So at the end we landed at: Hoorray, fixed 😁

[tofuSCHNITZEL]

And should we add "SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1" to the official htaccess?
seems to me that it would do no harm if not needed?

[tofuSCHNITZEL]

Adding
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
to .htaccess seems to solve the problem.

[kevinpapst]

I created a bug here to follow: #4774

The error now shows up in my logs as well.
I still have no idea how to reproduce the issue though.
What users did you use for testing? System-Admins? Regular users?
Can you share your docker-compose so I can test it with your setup?

[tofuSCHNITZEL]

Adding
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
to .htaccess seems to solve the problem.

[kevinpapst]

Hm, good idea. I just checked the official Symfony recipe:
https://github.com/symfony/recipes-contrib/blob/main/symfony/apache-pack/1.0/public/.htaccess#L38

Seems I didn't merge these files for a long time.
I'd like to stick as close to the "Standard".
Could you give that a try and see if it works as well?

[tofuSCHNITZEL]

yes!
I replaced the existing htaccess with this one and it also works!
so you only need to merge this upstream htaccess and we are good to go ;)

[kevinpapst]

Already added to the next release:
f8ef525

Sometimes it is really frustrating to find and fix such environment specific issues.
I wouldn't have found the cause without you.

Big thanks for your support 👍

[tofuSCHNITZEL]

I totally understand... Thank you for taking the time and the patience to get to the bottom of this!