[Zope-Coders] FastCGI leaking Authorization header

[Matt Behrens]

--bg08WKrSYDhXBjb5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 19, 2002 at 11:39:20AM -0400, Shane Hathaway wrote:

> Can you think of a way to release a correction that wouldn't be
> interpreted by people outside this community as "Zope is totally
> insecure"?

Ultimately, it's a workaround for FastCGI's new (2.2) broken behavior
of stuffing Authorization into the environment instead of as a
header.

But, it should have been spotted when FCGIServer was written, I
think the FastCGI 2.2 "workaround" for Authorization appearing as
an environment variable went back to to the initial import.  But
that point could be left out I suppose :-)

--=20
Matt Behrens <matt@zigg.com> <URL:http://zigg.com/>

--bg08WKrSYDhXBjb5
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9YRSz+xq4JbgNGlMRApbfAJwPUmCPoMtRdsJdrNnTro7W05KqowCeL8xl
dXZqpG+fOyj9bVC9eMcm5lc=
=lxdn
-----END PGP SIGNATURE-----

--bg08WKrSYDhXBjb5--