The new editor only shows "Check permission" with an endless loading spinner.

This is caused by two issues.

1. These endpoints initially return HTTP 500:

/rest/v1/version-info
/rest/v1/user-permissions

The .htaccess rewrite does not determine the correct base path.

Add:

RewriteCond %{REQUEST_URI}::$1 ^(.?/)(.)::\2$
RewriteRule ^(.*)$ - [E=BASE:%1]

and replace:

RewriteRule . index.php

with:

RewriteRule ^ %{ENV:BASE}index.php

See: https://stackoverflow.com/questions/21062290/set-rewritebase-to-the-current-folder-path-dynamically

This fixes /rest/v1/version-info.

2. Authenticated REST endpoints return 401

After fixing the rewrite, /rest/v1/user-permissions and other authenticated endpoints return HTTP 401.

The browser sends the Bearer header, but on IONOS it is available in PHP as:

$_SERVER['REDIRECT_HTTP_AUTHORIZATION']

Add this fallback to getAuthBearerToken() in:

/limesurvey/application/libraries/Api/Rest/Endpoint/EndpointFactory.php

if (
!isset($headers['authorization'])
&& isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION'])
) {
$headers['authorization'] =
$_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
}

Apache seems to add the REDIRECT_ prefix during rewrites.

Related issue:

https://github.com/martialblog/docker-limesurvey/issues/302

WordPress also checks REDIRECT_HTTP_AUTHORIZATION as a fallback:

https://developer.wordpress.org/reference/classes/wp_rest_server/get_headers/