UnionOfRAD/lithium — pull request #981 by davidpersson (2013-06-29 12:31:03+00:00)
Title: Enable HTTP basic and digest auth for FCGI/CGI environments

When running PHP as a CGI/FCGI PHP doesn't automatically parse the authorization header into `PHP_AUTH_*` headers. Thus HTTP authentication in such environments will fail.

This PR enables Lithium to take another look at `HTTP_AUTHORIZATION` and - if previous is not available - at `REDIRECT_HTTP_AUTHORIZATION`. Apache needs another workaround in form of an additional rewrite rule (I'm opening another PR on UnionOfRAD/framework for this).

I can confirm this to work with Apache but haven't had the chance to test on IIS or NGINX. Documentation on PHP as a CGI in combination with IIS are not clear. Some docs suggest that the `HTTP_AUTHORIZATION` header is available without additional rules, same for NGINX.

This patch should not affect existing functionality nor break BC. However as this is security related I'd like to have another pair of eyes on this.

For further suggestions to improve and further reasoning see the notes on commit a6e7f6cea82bcad0369bfa0dd6bbe6c4595b0306.
I'm not entirely sure about the removal of magic number in aecd499da7964735bb9dbab3989dafb37b8db0e0 either.