codeigniter-restserver: Authentication not working

Hi All, I’ve been trying this library recently and also experienced same issue. After some debugging, I’ve found out that the problem lies with how Codeigniter set output value. Codeigniter use output class to working with output. By default, these output class’s method are called internally when use $this->load->view() method.

But, this library is not using view method, it uses it’s own $this->response() method. In this method, we can see that it uses method from output class:

    public function response($data = NULL, $http_code = NULL)
    {
	ob_start();
...
...
        // Output the data
        $this->output->set_output($output);

        ob_end_flush();
    }

As we can see from the codeigniter user guide, this method comes with a warning:

If you do set your output manually, it must be the last thing done in the function you call it from. For example, if you build a page in one of your controller methods, don’t set the output until the end.

When we use basic authentication , method $this->response() is called twice. The first one is when REST_Controller is constructed and go to $this->_prepare_basic_auth();. And the second one is in our API method to send out whatever result we wanted. So basically, the output is replaced with the latest $this->response() call, and by this is the result that we want to show if we pass the authentication and the authentication is not work. So if you try to call an empty API method like this:

       public function user_get(){
           // empty method
       }

the authentication is working fine.

So my workaround is to add a check to response method to check if output is already been set (either by authentication or error message) using codeigniter $this->output->get_output() method. If yes, we will send out that output instead.

So, this is my response method look like:

    public function response($data = NULL, $http_code = NULL)
    {
        if ($this->output->get_output()!=null) {
            return;
        }
	ob_start();
...
...
...
        ob_end_flush();

        // Otherwise dump the output automatically
    }

And the authentication is working fine now.

Evidently sometimes the Authorization header can be stripped? I had success adding the following to my .htaccess:

RewriteCond %{HTTP:Authorization} ^(.+)$ RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

I had to come back to this thread because it stopped working for me on my applications and after much debugging this .htaccess code did the trick for me.

Before adding it, my usr:pwd combination was not giving me access and also enabling: allow_auth_and_keys to allow both authentication as well as keys was not working either.

After applying the above rules on the .htaccess, it started working across the board, so thank you!

I have a similar problem when using the basic authentication, the server is removing the header, I found a solution here, https://hetzner.co.za/help-centre/website/php_auth-fastcgi/, but this implies the modification of the class REST_Controller.php, I wonder if the author has another solution or can add these instructions to the code. Note function _prepare_basic_auth would have to add the field in REDIRECT_HTTP_AUTHORIZATION

Evidently sometimes the Authorization header can be stripped? I had success adding the following to my .htaccess:

RewriteCond %{HTTP:Authorization} ^(.+)$ RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

I think I found a way to make it work (it definitely works for me).

At the end of function _remap($object_called, $arguments = []) there’s a bit of code which seems to actually call the controller method and passed arguments no matter what happens(Line: 795). As I’m not entirely sure what are the cases covered by the function’s logic, I switched a variable on false every time an error response was called and then modified the last bit to only run if no responses were already sent:

if ($go)
        {
            // Call the controller method and passed arguments
            try
            {
                call_user_func_array([$this, $controller_method], $arguments);
            }
            catch (Exception $ex)
            {
                if ($this->config->item('rest_handle_exceptions') === FALSE) {
                    throw $ex;
                }
                // If the method doesn't exist, then the error will be caught and an error response shown
                $_error = &load_class('Exceptions', 'core');
                $_error->show_exception($ex);
            }
        }

So, basically I added that $go variable which I initialized on true and switched on false every time a response happened:

$response = [$this->config->item('rest_status_field_name') => FALSE, $this->config->item('rest_message_field_name') => $this->lang->line('text_rest_ip_address_time_limit')];
$this->response($response, self::HTTP_UNAUTHORIZED);
$go = false;

One might still get 2 rows in the logs(because of the function’s logic) but now, the second response code should be 0 instead 200.