[Zope-Coders] FastCGI leaking Authorization header

[Toby Dickenson]

On Monday 19 Aug 2002 3:06 pm, Shane Hathaway wrote:
> Matt Behrens wrote:

> and even those sites will still have to deal with the
> very same risk even after the change: site managers should never browse
> to untrusted users' pages while logged in.

>  Until we have
> "hat-switching", it will never be safe for privileged users to browse t=
o
> untrusted users' pages.

Thats a bogus argument, for two reasons. With this current problem even h=
onest=20
trusted users could accidentally write code that exposes users passwords.=
=20
Also it doesnt just affect site managers - all users who provide=20
authentication would have to be careful (realistically, that is asking to=
o=20
much of most users)


want an example? I have products that occasionally send the result of=20
<dtml-var "REQUEST.text()"> by email, to widely accessible mailbox, over =
an=20
untrusted network. It would be a big suprise if those emails should sudde=
nly=20
contain passwords if I should downgrade (;-) to FastCGI