<p><a href="https://craftcms.com/docs/4.x/graphql.html#querying-a-private-schema" rel="nofollow noreferrer">In the docs</a>, the following is written:</p>
<blockquote>
<p>Apache strips Authorization headers by default, which can be fixed by enabling CGIPassAuth or adding the following to your .htaccess file:</p>
</blockquote>
<pre><code>RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
</code></pre>
<p>It seems like, that I'm facing this problem. When I add those two lines in my .htaccess file inside the web folder, nothing changes. I still get this response:</p>
<pre><code>{
    &quot;name&quot;: &quot;Bad Request&quot;,
    &quot;message&quot;: &quot;Missing Authorization header&quot;,
    &quot;code&quot;: 0,
    &quot;status&quot;: 400,
    &quot;type&quot;: &quot;yii\\web\\BadRequestHttpException&quot;
}
</code></pre>
<p>This is what my .htaccess file looks like:</p>
<pre><code>&lt;IfModule mod_rewrite.c&gt;
    RewriteEngine On

    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

    # Send would-be 404 requests to Craft
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
    RewriteRule (.+) index.php?p=$1 [QSA,L]
&lt;/IfModule&gt;
</code></pre>
<p>Do I need to put a .htaccess file with the two lines somewhere else for this to work?
I have set up the route for GraphQL as described in the docs: <code>'api' =&gt; 'graphql/api'</code></p>

CC BY-SA 4.0
2023-02-03T11:25:57.163Z
I have the same problem. Did you find a solution @obs?
I have, in contrast to your problem, the message "Invalid Authorization header".

I also added the rewrite stuff in my /web/.htaccess file, but no effect... :S
Merc
CC BY-SA 4.0
2023-02-03T12:27:28.667Z
Hm maybe it is because my whole .htacess has no effect at all. I am using ddev and I think per default it is using nginx and not apache...
Merc
<htaccess><graphql>
Getting GraphQL working with Authorization header
# Getting GraphQL working with Authorization header

(Asked by: username_0 on 2022-05-20)

In the docs, the following is written:

Apache strips Authorization headers by default, which can be fixed by enabling CGIPassAuth or adding the following to your .htaccess file:

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

It seems like, that I'm facing this problem. When I add those two lines in my .htaccess file inside the web folder, nothing changes. I still get this response:
{
    "name": "Bad Request",
    "message": "Missing Authorization header",
    "code": 0,
    "status": 400,
    "type": "yii\\web\\BadRequestHttpException"
}

This is what my .htaccess file looks like:

    RewriteEngine On

    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

    # Send would-be 404 requests to Craft
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
    RewriteRule (.+) index.php?p=$1 [QSA,L]


Do I need to put a .htaccess file with the two lines somewhere else for this to work?
I have set up the route for GraphQL as described in the docs: 'api' => 'graphql/api'

**Tags:** htaccess, graphql

> **Comments:**
> **username_1**: I have the same problem. Did you find a solution @username_0? I have, in contrast to your problem, the message "Invalid Authorization header".  I also added the rewrite stuff in my /web/.htaccess file, but no effect... :S  
> **username_1**: Hm maybe it is because my whole .htacess has no effect at all. I am using ddev and I think per default it is using nginx and not apache...  

---

## 0 answers

