Experiments with server side development of HTTP Origin Based Authentication (RFC 7486)
Licensed under GPLv3
This has been developed/tested with Apache2.4 on OpenBSD and FreeBSD
The directory foo/hoba-ssl/.well-known/hoba contains symbolic links to the actual PHP scripts in foo/hoba-ssl/
<Directory foo/hoba-ssl>
Options FollowSymlinks
AllowOverride all
Order allow,deny
Allow from all
SetHandler php7-script
# Allow Authorization header to be modified
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
</Directory>
<Directory foo/hoba-ssl/.well-known/hoba>
Options FollowSymLinks
SetHandler php7-script
</Directory>
There is a test website up and running to play with this @ https://hoba.name/