# Apache (XAMPP's default) strips the Authorization header before it
# reaches PHP unless this is explicitly enabled. Without it, every endpoint
# that requires a login token responds "Not authenticated" even with a
# valid token, because PHP never sees the header at all.
<IfModule mod_php.c>
  SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP:Authorization} ^(.*)
  RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
</IfModule>

# Apache 2.4.13+: the modern, preferred way to do this.
<IfModule mod_authz_core.c>
  CGIPassAuth On
</IfModule>
