Proxy oAuth requests between Consumer and Provider

we have an issue with how to proxy oAuth 1.0a requests with an intermediate proxy server between the consumer (client) and the provider (oAuth server).

Basically it looks something like this:

------------
| Consumer |
------------
      |
      V
------------
|  Proxy   |
------------
      |
      V
----------------
| oAuth Server |
----------------

The possible issue that we think of, is that when resending the HTTP request to our oAuth server, the Apache of the proxy server will set some of the request Headers to different values, and when the request is signed at the oAuth server, the signatures will not match.

Do you know if there's way that the proxy server resend the request without any modifications, so the signing will b开发者_如何学Ce valid in the oAuth case?

Another option that we're thinking of, is to replace the modified headers at the oAuth server before signing, and thus modify the request to appear as not coming from a proxy, but directly from the client. Do you think this is possible in PHP - replace the headers of the request, e.g. $_SERVER variables?

Thank you

It turned out that the only HTTP header that is used by the client when signing the request is the HTTP HOST header. That does not include the special OAuth headers in case the oAuth parameters are passed as OAuth headers.

So the only thing that the proxy should do is to send us the HOST header that was used by the client to sign the request.

Example: Let's assume that, if the client (consumer) is making HTTP request to proxy server in order to get token, it sends the request to the following endpoint:

http://proxy.com/oauth/request

In this case the request will be something like this, and the Host header with value proxy.com will be used when signing the request.

POST /oauth/request HTTP/1.1
Host: proxy.com

Let's assume, that the endpoint at which our oAuth server expects requests is:

http://oursite.com/oauth/request

When the proxy server receives the request it can resend it to our endpoint and give us the value proxy.com in additional HTTP header that we can use to sign the request at our side, instead of using the original HOST header which will be with value oursite.com