Consistent 403 Error from REST API on v 1.9.3.2

Question

The Setup

I've been through every post I can find on this and still no luck. I've got code for authorizing with and connecting to the REST API. In a test environment running 1.9.1.1 this all works flawlessly, in production running 1.9.3.2 it's always getting a 403.

What I've Tried

I've been over the configuration multiple times, the roles and permissions are configured correctly, everything is the same, yet it always fails in production.

Other Info

The company maintaining the server are sure the request is being handled by Magento, and one curious thing I have noticed is that if I omit part of the authorization header in test it'll tell me:

{"error":[{"code":401,"message":"oauth_problem=parameter_absent&oauth_parameters_absent=oauth_signature_method"}]}}

In production the only response I ever get back when hitting a valid URL is:

{"messages":{"error":[{"code":403,"message":"Access denied"}]}}

The only other difference is that production forces HTTPS, while in the test environment there's no valid cert and so I have to use HTTP.

Answer 1

After digging through more and more with the company running the server, it appears as though the Authorization header was being stripped as detailed on magentogeek.com:

It seems Apache was stripping the Authorization and Content-Type header to improve security. So there was no headers given to php-fpm from FastCGI. The solution is to explicitly tell FastCGi to pass the Authorization header to php-fpm. In your fastcgi configuration file, make the following change (on Ubuntu it lies in /etc/apache2/mods-available)

FastCGIExternalServer /var/www/cgi-bin/php5.fcgi -socket /var/run/php5-fpm.sock -idle-timeout 600 -pass-header Authorization -pass-header Content-Type

Posting this here as I never found anything pertaining to this cause in all my searching, it was only when we knew about the missing header that the answer was easy to find.