关于$_SERVER['HTTP_TOKEN']和$_SERVER['HTTP_ACCEPT']为空的技术求助

Hey there! Let's break this down step by step to help you understand what's going on with those $_SERVER variables and why they're empty.

Let's start with each one individually:

• $_SERVER['HTTP_ACCEPT']: This is a standard HTTP request header that clients (like browsers, Postman, or mobile apps) send to tell your server what types of content it can accept in response. For example, a browser might send Accept: text/html,application/xhtml+xml to indicate it can handle HTML or XHTML content. PHP automatically maps standard request headers to $_SERVER variables by prefixing them with HTTP_, converting to uppercase, and replacing hyphens with underscores.
• $_SERVER['HTTP_TOKEN']: This isn't a standard HTTP header. It's a custom header that your application expects to receive from the client. Typically, this would correspond to a request header named Token (e.g., Token: abc123 sent in the request) — PHP converts custom headers to $_SERVER variables using the same rule as above: add HTTP_, uppercase, replace hyphens with underscores. If your app is expecting a token via a different header (like Authorization: Bearer abc123), that would map to $_SERVER['HTTP_AUTHORIZATION'] instead.

Empty values here usually boil down to missing headers from the client, or server/proxy configuration issues:

For $_SERVER['HTTP_ACCEPT'] #

• The client didn't send the Accept header: While most browsers send this automatically, custom requests (like those made with curl or a poorly configured API client) might omit it.
• PHP configuration issues: Check your php.ini file for the variables_order or request_order settings. If these don't include E (for environment variables, which is where $_SERVER pulls these values from), the variables won't be populated.
• Reverse proxy filtering: If your app is behind a proxy (like Nginx or Apache), the proxy might be stripping or not forwarding the Accept header. You'll need to adjust proxy settings to pass this header through.

For $_SERVER['HTTP_TOKEN'] #

• The client isn't sending the custom Token header: This is the most common reason. Your frontend/mobile app needs to explicitly include this header in every request that requires it (e.g., Token: your-auth-token).
• Misnamed header: If your client is sending a header like Authorization instead of Token, you'll need to check for $_SERVER['HTTP_AUTHORIZATION'] instead. Double-check the header name being sent vs what your code is looking for.
• Reverse proxy not forwarding the header: Proxies often don't pass custom headers by default. You'll need to configure your proxy to forward the Token header to your backend. For example, in Nginx, you'd add proxy_set_header Token $http_token; inside your location block.

Let's go through actionable steps for each variable:

Fixing $_SERVER['HTTP_ACCEPT'] #

1. Verify the client is sending the header: Use browser dev tools (F12 → Network tab) or tools like Postman to check if the Accept header is present in the request.
2. Add the header manually for custom requests: If you're testing with curl, add -H "Accept: application/json" (or whatever content type you need) to your command. In Postman, use the "Headers" tab to add the Accept key and value.
3. Check PHP configuration: Open your php.ini file and ensure variables_order includes E (e.g., variables_order = "GPCSHE"). Restart your web server after making changes.
4. Adjust proxy settings: If using a proxy, confirm it's configured to pass the Accept header. For Apache, you might need ProxyPreserveHost On; for Nginx, ensure there's no rule stripping the header.

Fixing $_SERVER['HTTP_TOKEN'] #

1. Confirm the client sends the correct header: Have your frontend team check that they're including the Token header in requests, or test it yourself in Postman by adding the Token header and a test value.
2. Use getallheaders() to debug: This PHP function returns all incoming request headers as an associative array (using their original names, like Token instead of HTTP_TOKEN). Run var_dump(getallheaders()); to see exactly what headers your server is receiving.
3. Configure your proxy to forward the header: If behind a proxy, add the necessary configuration to pass the Token header. For Nginx, add proxy_set_header Token $http_token; to your location block; for Apache, use RequestHeader set Token "%{HTTP_TOKEN}e" (you might need to enable mod_headers first).
4. Double-check header naming: If you meant to use the standard Authorization header instead of a custom Token, update your code to check $_SERVER['HTTP_AUTHORIZATION'] instead.

内容的提问来源于stack exchange，提问作者namratha