CGIPassAuth allows scripts access to HTTP authorization headers such as Authorization , which is required for scripts that implement HTTP Basic authentication. Normally these HTTP headers are hidden from scripts. This is to disallow scripts from seeing user ids and passwords used to access the server when HTTP Basic authentication is enabled in the web server. This directive should be used when scripts are allowed to implement HTTP Basic authentication.

This directive can be used instead of the compile-time setting SECURITY_HOLE_PASS_AUTHORIZATION which has been available in previous versions of Apache HTTP Server.

The setting is respected by any modules which use ap_add_common_vars() , such as mod_cgi , mod_cgid , mod_proxy_fcgi , mod_proxy_scgi , and so on. Notably, it affects modules which don't handle the request in the usual sense but still use this API; examples of this are mod_include and mod_ext_filter . Third-party modules that don't use ap_add_common_vars() may choose to respect the setting as well.