[Zope-Coders] FastCGI leaking Authorization header

[Toby Dickenson]

On Monday 19 Aug 2002 4:07 pm, Casey Duncan wrote:
> The point is not whether the issue shot be fixed, but whether it is ser=
ious
> enough to warrant a Hotfix and all of the cerimony and buzz that goes w=
ith
> it.

agreed.=20

> IMHO, we should just patch 2.5 and the trunk and consider it a bugfix.=20

>This
> is not an active flaw that can be exploited by walking up to a random Z=
ope
> site.

Not all zope sites - only the ones using FastCGI, and using software deve=
loped=20
under the security model of every other front end.

> The point is that it is no more insecure then HTTP basic
> auth itself which is the way many people authenticate over the web.

So those 'many' dont need to install the hot fix! That doesnt make it any=
 less=20
important for administrators of a site that do use FastCGI, and who use B=
asic=20
authentication in a secure manner.


(unless FastCGI is such a minority interest that noone is in this positio=
n. If=20
so, we should have removed it from the Zope core before now.  To be hones=
t, I=20
have no idea how popular it is.)