From: Jeff King <peff@peff.net>
Date: Thu, 05 May 2016 20:03:27 GMT
Subject: Re: [PATCH v6 1/2] http: support sending custom HTTP headers
Message-ID: <20160505200327.GC9162@sigill.intra.peff.net>
In-Reply-To: <67F2E414-657C-4C6C-9746-9B3026737C66@gmail.com>

On Thu, May 05, 2016 at 09:10:21PM +0200, Lars Schneider wrote:

> > +<LocationMatch /smart_headers/>
> > +	<RequireAll>
> > +		Require expr %{HTTP:x-magic-one} == 'abra'
> > +		Require expr %{HTTP:x-magic-two} == 'cadabra'
> > +	</RequireAll>
> 
> I think "<RequireAll>" depends on mod_authz_core which is only
> available in Apache HTTPD 2.3 or later [1].
> 
> Right now the test only checks if Apache version greater 2
> is installed. Should we guard this test with a special version
> check? Or do you see a way to check the magic values without
> "<RequireAll>"?

I think you can get rid of RequireAll with:

 Require expr %{HTTP:x-magic-one} == 'abra' && %{HTTP:x-magic-two} == 'cadabra'

But I am also not sure that "expr" existed in Apache 2.2.

I think the older way of checking headers was to do some trickery with
RewriteCond; I tried briefly to make that work when I wrote the test,
but never did (but I'm far from an expert in Apache; the only reason I
have touched it in the last 15 years is for Git's test suite).

The nuclear option would be to put a shell script between Apache and
git-http-backend that checks for those headers (I suspect we'd still
need some magic in the Apache config to pass the headers out in the
environment, though).

-Peff