Header sent from Java changes it name on PHP side

November 11, 2021

I am sending X-Auth-HMAC header from Java using HttpClient to Nginx + PHP-FPM combo:

        HttpClient
                .newBuilder()
                .build()
                .sendAsync(
                        HttpRequest.newBuilder()
                                .uri("php-fpm:80")
                                .header("Content-Type", "application/json")
                                .header("X-Auth-HMAC", "test_hmac_header")
                                .POST(HttpRequest.BodyPublishers.ofString("test_body"))
                                .build(),
                        HttpResponse.BodyHandlers.ofString()
                );

But on PHP side in $_SERVER variable among all headers i get:

  ...
 "HTTP_X_AUTH_HMAC":"test_hmac_header",
 ...

How could X-Auth-HMAC become HTTP_X_AUTH_HMAC ?

>Solution :

PHP formats HTTP headers in the $_SERVER variable according to RFC 3875 (the CGI 1.1 spec).

Specifically section 4.1.18:

Meta-variables with names beginning with HTTP_ contain values read
from the client request header fields, if the protocol used is HTTP.
The HTTP header field name is converted to upper case, has all
occurrences of – replaced with _ and has HTTP_ prepended to give the
meta-variable name.

Take a loot at this answer for more discussion and alternate methods of getting HTTP headers: How do I read any request header in PHP