How to use GraphQL tokens behind basic auth?

[gopeter]

I'm running Craft CMS behind Nginx where I've configured basic authentication for my staging setup. Now I want to use private GraphQL schemas, but my frontend can't send the basic auth credentials and the GraphQL token. Is there a way to customize the Authorization header?

[brandonkelly]

You can pass both the Basic and Bearer tokens together in the same Authorization header:

Authorization: Basic XXXXXXXXXXXXXXXX, Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

[gopeter]

But this is against the RFC. Some users also mentioned that it does not work with Apache. That's why I thought that it would be better to allow users to customize the header :-)

[brandonkelly]

Ah ok, didn’t know that!

[brandonkelly]

Just added support for passing the bearer token via an X-Craft-Authorization header (0fce7a7).

[gopeter]

Thanks a lot 😊

[brandonkelly]

Craft 3.7.33 is out now with this change.

[janhenckens]

Well, today I learned something. Was struggling with the same issue on our staging setup (which runs apache), using X-Craft-Authorization fixed it 👍