Remove WWW-Authenticate header

Question

I have a page on my apache which I protect with Basic Auth.

With a JavaScript, I want to check if the browser has any credentials for that page or not, so I want to load the page with a jQuery ajax call, hoping for getting either the page or an 401 error. Unfortunately, the browser always asks me for credentials in the latter case, which I do not want – I just want to know if I needed credentials or not!

I've read that the browser only asks if the WWW-Authenticate: header is set, so I want to suppress it or edit it so that the browser doesn't know it.

This is my .htaccess (the edit line comes from coderwall.com):

Authtype Basic
AuthName "abcdef"
AuthUserFile some/folder/at/the/xampp/.htpasswd
Require valid-user

Header always add HelloHello "Blupp"
Header always edit WWW-Authenticate ^Basic SR_Basic

This is (partly) what I get with curl -I <url>:

HTTP/1.1 401 Unauthorized
Date: Thu, 14 Sep 2017 12:48:52 GMT
Server: Apache/2.4.17 (Win32) OpenSSL/1.0.2d PHP/5.6.21
WWW-Authenticate: Basic realm="abcdef"
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Content-Type: text/html; charset=utf-8
Content-Language: en

You see, the WWW-Authenticate header is not modified, and the HelloHello header has not been applied! When I comment out the first 4 lines (the basic auth), I correctly get the HelloHello: Blupp.

Using the line Header always unset WWW-Authenticate instead brings no change.

How can I modify / suppress the header?

Answer 1

The problem here is the order that Apache modules are loaded and processed.

You can see the modules order running this command:

apache2ctl -M

You'll see that auth_*_module are loaded before the headers_module so you cannot add headers or modify existing ones.

Loaded Modules:
...
...
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
...
...
 headers_module (shared)
...
...

Viewing the Apache documentation, the loading order of the modules is determined in the module's own source code.

Answer 2

I traced that Apache 2.4.25 (as in Debian 9 "stretch") adds the "WWW-Authenticate" header in mod_auth_basic.c (to r->err_headers_out) and afterwards handles the Apache configuration "Header" directive in mod_headers.c which unfortunately operates on a different copy of r->err_headers_out in mod_headers.c:ap_headers_error_filter().

When adding a second do_headers_fixup() to ap_headers_error_filter() as done in ap_headers_output_filter() to operate on r->headers_out also, the problem is gone.

Not sure if Apache considers this problem as a bug or a feature.

Update: The respective issue report at apache.org, including proposed patch, is at: https://bz.apache.org/bugzilla/show_bug.cgi?id=62025