He says he can't use mod_proxy_fcgi, because the Authorization header is stripped by mod_proxy, but this is documented behavior.

He should simply add

SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1

to his config.

With https://gist.github.com/progandy/6ed4eeea60f6277c3e39 (or Apache 2.4.10+) and 5.6.0RC2+, there are no more issues like double slashes or errors when rewriting to PATH_INFO (see PR link below).

The "break" in question was caused by https://github.com/php/php-src/pull/694; it fixes the issue described in https://bugs.php.net/bug.php?id=67541.

It also makes https://bugs.php.net/bug.php?id=65641 obsolete

mod_fastcgi is old, crappy, unmaintained, deprecated stuff. People should use mod_proxy_fcgi with Apache 2.4.

I'll try and see if I can figure out a way of fixing the original issue without causing the breakage described here (need to get mod_fastcgi working first, which isn't trivial unfortunately).

David: the original premise on that pull request was that the removed parts shouldn't really affect existing installations:
"Clearly, neither applies in the case of FastCGI, so both are safe to delete."
I would be glad if we could keep the compatibility with mod_fastcgi.

Yes, agreed, I'm looking into it. Building mod_fastcgi with recent Apache versions is actually a bit of a challenge, but no worries, we'll get there. Expect an updated patch soon; I want to get a fix into RC3.

Who is that "dzuek" assignee guy though? ;)

To explain the issue a bit, the breakage seems to stem from intentionally broken or non-existant paths handed to mod_fastcgi so it somehow knows to pass stuff to PHP-FCGI (it's all quite hacky, as many comments on the Interwebs point out).

In more recent versions of Debian, apparently php-fcgi is the FPM, not the CGI binary. That's why the FPM change affects this. People are using this approach because it was documented before FPM existed.

The code that my PR removed basically inadvertently fixed up those paths even though it was meant to address something totally different.

Will report back with more findings.

thanks for the heads-up!

David,

1) Debian has patched mod_fastcgi that works with Apache 2.4 if you need compilable source code: https://packages.qa.debian.org/liba/libapache-mod-fastcgi.html

2) I am not saying this has to be fixed in FPM, if you can come up with fix for mod_fastcgi, I think it be sufficient.

Also "php-fcgi" is just a placeholder, it could be named "queen-of-england" and it would work the same.  It just have to match the other parts of the config file and the important part is the "FastCgiExternalServer".

Ondrej

Fixed in https://github.com/php/php-src/pull/765

This has been merged in 844e2e81f56fca1f49c73df4e15866cd1ba37f30, so this issue can be closed.

Thank you for your bug report. This issue has already been fixed
in the latest released version of PHP, which you can download at 
http://www.php.net/downloads.php

Ported to 5.4 in ee275e34c8b303945945c650d4bc90dcc2ac0b17 / b206b0e29d2cf9a41b94befedfefd806a71d0846 and merged to 5.5 in e55c641792df2caf813b5df3272144974e4d8fc7