Why Apache is authenticating but not serving AUTHENTICATE variables in some routes? - php

Question

I have a Virtual Host in a WAMP server. To acces that VH, you need to authenticate to a LDAP server, so I configured it like this:
<VirtualHost *:80>
ServerName myserver
DocumentRoot /apps/portal/public
<Directory "/apps">
Options FollowSymLinks
AllowOverride None
AuthType Basic
AuthBasicProvider ldap
AuthName "My Autenticacion"
AuthLDAPURL "ldaps://myldapserver:636/DC=DOM1,DC=COM?sAMAccountName,memberOf?sub?(objectClass=*)"
AuthLDAPBindDN myuser
AuthLDAPBindPassword mysecret
LDAPReferrals Off
Require valid-user
</Directory>
# My Laravel 7 app:
Alias /myapp /apps/myapp/public
<Directory "/apps/myapp/public">
# Laravel rewrites:
RewriteEngine On
RewriteBase /myapp/
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [L,R=301]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
</Directory>
</VirtualHost>
So, all applications are under the /apps local directory. You can access the host via http://myserver. You can access the Laravel 7 application via http://myserver/myapp.
In that application I read the contents of the PHP variable $_SERVER['AUTHENTICATE_MEMBEROF']. When I visit http://myserver/myapp everything goes fine. But let's say I define one route like this:
Route::get('about', function() {
return view('about');
})->name('about');
Really simple. But as soon as I go to http://myserver/myapp/about, I get this error:
Undefined index: AUTHENTICATE_MEMBEROF
Furthermore, I've realized that none of the AUTHENTICATE_* server variables are served in this page. However, if I want to access http://myserver/myapp/about, the server prompts for credentials. So it's authenticating the user, but not serving the AUTHENTICATE_* variables.
What am I missing?
EDIT: Well, finally, I've found out that in all these routes, all AUTHENTICATE_* variables are available through a different name, which is REDIRECT_AUTHENTICATE_*, which doesn't seem to be documented anywhere. I assume this has to do with the rewrites, but anyone could explain why this new names, and whether it is possible or not to avoid these renamings?