https://bz.apache.org/bugzilla/show_bug.cgi?id=66480
abernal <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #4 from abernal <[email protected]> --- This is already documented: your own code pointer in comment 1 (r1907762, "fixups vs. early in check_authn") added a note to AuthBasicFake's docs that answers (a)/(b) directly: "The Authorization header added by this directive is not input into any authentication or authorization within the local server. It is designed to be passed along to upstream servers." The reason is in the hook ordering: authenticate_basic_fake() runs on ap_hook_fixups with APR_HOOK_LAST, i.e. after the check_authn/check_authz phase has already run. So it can never feed the local server's own AuthUserFile/Require decision - it only sets the header for whatever is behind this server to consume. On the last question: AuthType is not required. authenticate_basic_fake() doesn't inspect AuthType at all; it fires unconditionally during fixups whenever AuthBasicFake is configured for the request. Closing as already covered by the existing note. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
