Re: AUTHENTICATED_USER is not reliable! [Was: [Zope] become user (su inside Zope) - pretend to be another user]

Stefan H. Holek wrote:

Why is everybody so obsessed with AUTHENTICATED_USER? This variable is not suitable for anything deserving the name "security". It is NOT SAFE to assume that it will contain anything useful.

Good job core products like RAM Cache Manager use AUTHENTICATED_USER by default then ;) -- Andy McKay ClearWind Consulting http://www.clearwind.ca