Body: <p><a href="https://craftcms.com/docs/4.x/graphql.html#querying-a-private-schema" rel="nofollow noreferrer">In the docs</a>, the following is written:</p>
  <blockquote>
  <p>Apache strips Authorization headers by default, which can be fixed by enabling CGIPassAuth or adding the following to your .htaccess file:</p>
  </blockquote>
  <pre><code>RewriteCond %{HTTP:Authorization} ^(.*)
  RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  </code></pre>
  <p>It seems like, that I'm facing this problem. When I add those two lines in my .htaccess file inside the web folder, nothing changes. I still get this response:</p>
  <pre><code>{
      &quot;name&quot;: &quot;Bad Request&quot;,
      &quot;message&quot;: &quot;Missing Authorization header&quot;,
      &quot;code&quot;: 0,
      &quot;status&quot;: 400,
      &quot;type&quot;: &quot;yii\\web\\BadRequestHttpException&quot;
  }
  </code></pre>
  <p>This is what my .htaccess file looks like:</p>
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
      RewriteEngine On
  
      RewriteCond %{HTTP:Authorization} ^(.*)
      RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  
      # Send would-be 404 requests to Craft
      RewriteCond %{REQUEST_FILENAME} !-f
      RewriteCond %{REQUEST_FILENAME} !-d
      RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
      RewriteRule (.+) index.php?p=$1 [QSA,L]
  &lt;/IfModule&gt;
  </code></pre>
  <p>Do I need to put a .htaccess file with the two lines somewhere else for this to work?
  I have set up the route for GraphQL as described in the docs: <code>'api' =&gt; 'graphql/api'</code></p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-02-03T11:25:57.163Z
Comments.Text: I have the same problem. Did you find a solution @obs?
  I have, in contrast to your problem, the message "Invalid Authorization header".
  
  I also added the rewrite stuff in my /web/.htaccess file, but no effect... :S
Comments.UserDisplayName: Merc
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-02-03T12:27:28.667Z
Comments.Text: Hm maybe it is because my whole .htacess has no effect at all. I am using ddev and I think per default it is using nginx and not apache...
Comments.UserDisplayName: Merc
Tags: <htaccess><graphql>
Title: Getting GraphQL working with Authorization header
ThreadText: # Getting GraphQL working with Authorization header
  
  (Asked by: username_0 on 2022-05-20)
  
  [In the docs](https://craftcms.com/docs/4.x/graphql.html#querying-a-private-schema), the following is written:
  
  > Apache strips Authorization headers by default, which can be fixed by enabling CGIPassAuth or adding the following to your .htaccess file:
  
  ```
  RewriteCond %{HTTP:Authorization} ^(.*)
  RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  
  ```
  
  It seems like, that I'm facing this problem. When I add those two lines in my .htaccess file inside the web folder, nothing changes. I still get this response:
  
  ```
  {
      "name": "Bad Request",
      "message": "Missing Authorization header",
      "code": 0,
      "status": 400,
      "type": "yii\\web\\BadRequestHttpException"
  }
  
  ```
  
  This is what my .htaccess file looks like:
  
  ```
  <IfModule mod_rewrite.c>
      RewriteEngine On
  
      RewriteCond %{HTTP:Authorization} ^(.*)
      RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  
      # Send would-be 404 requests to Craft
      RewriteCond %{REQUEST_FILENAME} !-f
      RewriteCond %{REQUEST_FILENAME} !-d
      RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
      RewriteRule (.+) index.php?p=$1 [QSA,L]
  </IfModule>
  
  ```
  
  Do I need to put a .htaccess file with the two lines somewhere else for this to work?
  I have set up the route for GraphQL as described in the docs: `'api' => 'graphql/api'`
  
  **Tags:** htaccess, graphql
  
  > **Comments:**
  > **username_1**: I have the same problem. Did you find a solution @username_0? I have, in contrast to your problem, the message "Invalid Authorization header".  I also added the rewrite stuff in my /web/.htaccess file, but no effect... :S  
  > **username_1**: Hm maybe it is because my whole .htacess has no effect at all. I am using ddev and I think per default it is using nginx and not apache...  
  
  ---
  
  ## 0 answers
  
  