Various Apache modules will strip the Authorization header, usually for “security reasons”. They all have different obscure settings you can tweak to overrule this behaviour, but you’ll need to determine exactly which module is to blame.
You can work around this issue by passing the header directly to PHP via the env:
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
apache通常会因为"安全原因"阻止Authorization header，需要在配置文件中开启。