title: Authorization header in Ruby on Rails accessed with key HTTP_AUTHORIZATION instead of Authorization?
body: <p>I'm hoping someone can clear something up for me. I'm using Rails 2.3.5, and I can access request headers in a controller action like this:</p>
  
  <pre><code>def index
    if request.headers['...'] == '...'
      ...
    end
  end
  </code></pre>
  
  <p>Or something similar. request.headers is an instance of <a href="http://api.rubyonrails.org/classes/ActionController/Http/Headers.html" rel="noreferrer">ActionController::Http::Headers</a> which appears to be a Hash. I would expect, therefore, that headers are keyed on the name I send. If I send a request however, with an <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.8" rel="noreferrer">Authorization</a> header, like so:</p>
  
  <pre><code>curl -H 'Authorization: OAuth realm="MyRealm",...' http://app/path
  </code></pre>
  
  <p>The following code in the action returns false:</p>
  
  <pre><code>if request.headers.include?('Authorization') ... 
  </code></pre>
  
  <p>Whereas the following echos out the value I send in the header:</p>
  
  <pre><code>render :text =&gt; request.headers['Authorization']
  </code></pre>
  
  <p>The following check returns true, interestingly enough:</p>
  
  <pre><code>if request.headers.include?('HTTP_AUTHORIZATION') ... 
  </code></pre>
  
  <p>And similarly, the following echoes out the value I send in the header:</p>
  
  <pre><code>render :text =&gt; request.headers['HTTP_AUTHORIZATION']
  </code></pre>
  
  <p>Seems like there is some magic happening that I'm unaware of. I'm completely confused as to why checking for the key 'Authorization' fails, but rendering the value of request.headers['Authorization'] succeeds. I'm also confused as to where 'HTTP_AUTHORIZATION' is coming from as that is <em>not</em> the name of the header I'm sending with the request. Anyone know what's going on exactly? </p>