[Zope-Coders] FastCGI leaking Authorization header

[Matt Behrens]

--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Aug 17, 2002 at 12:09:24PM -0400, Shane Hathaway wrote:

> I don't think we need a hotfix.  Basic auth is insecure, and people who=
=20
> use it accept the risk of stolen passwords.

Most certainly.  However, I do also think that there are situations
where it is much easier to drop in a DTML method that surreptitiously
collects the data than drop in a sniffer between a privileged user
and his web server.  Basically: any public web site that allows
user-written DTML under the premise that it is "safe".

> There are other, easier ways to attack any site that allows untrusted=20
> users to write scripts, or even plain HTML, regardless of Zope.

Certainly.  But that does not mean that we should not fix problems
that we can.

> A hotfix would draw attention to a chink in the armor when there are=20
> actually gaping, unfixed holes in the whole web.

I have never considered obscurity a valid defense.  Anyone who
subscribes to zope-checkins already knows about this.  Anyone who
knows how to do <dtml-var REQUEST> on a FastCGI-equipped server has
seen it.

--=20
Matt Behrens <matt@zigg.com> <URL:http://zigg.com/>

--J/dobhs11T7y2rNN
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9YM1p+xq4JbgNGlMRAjysAKCxAxiRCG1pEKthE11iG/9/UXz/5gCaA9HK
390FJNLYpoQYQK9BblzGOC0=
=3Q+N
-----END PGP SIGNATURE-----

--J/dobhs11T7y2rNN--