[Zope-Coders] FastCGI leaking Authorization header

[Shane Hathaway]

On Mon, 19 Aug 2002, Matt Behrens wrote:

> On Mon, Aug 19, 2002 at 11:39:20AM -0400, Shane Hathaway wrote:
>
> > Can you think of a way to release a correction that wouldn't be
> > interpreted by people outside this community as "Zope is totally
> > insecure"?
>
> Ultimately, it's a workaround for FastCGI's new (2.2) broken behavior
> of stuffing Authorization into the environment instead of as a
> header.

So it's a workaround for a recent change made to FastCGI, then?  Would it
be possible to tell people they should not upgrade their FastCGI server
until the next release of Zope?  If not, at least this reasoning is easier
to understand.

> But, it should have been spotted when FCGIServer was written, I
> think the FastCGI 2.2 "workaround" for Authorization appearing as
> an environment variable went back to to the initial import.  But
> that point could be left out I suppose :-)

Ugh.  No one's perfect. ;-)

Shane