# Apache (esp. on XAMPP/Windows) strips the Authorization header before it
# reaches PHP. This rewrite rule re-injects it as an environment variable
# so $_SERVER['HTTP_AUTHORIZATION'] (and getAuthHeader() in index.php) works.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# Some setups also need this — passes Authorization through for CGI/FastCGI.
<IfModule mod_setenvif.c>
    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>
