[Zope-Coders] FastCGI leaking Authorization header

[Matt Behrens]

--RASg3xLB4tUQ4RcS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 19, 2002 at 12:17:00PM -0400, Shane Hathaway wrote:

> On Mon, 19 Aug 2002, Matt Behrens wrote:
>
> > Ultimately, it's a workaround for FastCGI's new (2.2) broken behavior
> > of stuffing Authorization into the environment instead of as a
> > header.
>
> So it's a workaround for a recent change made to FastCGI, then?  Would it
> be possible to tell people they should not upgrade their FastCGI server
> until the next release of Zope?  If not, at least this reasoning is easier
> to understand.

'New' is probably wrong; 2.2 is several years old, and I don't think
anyone's going to be fixing this issue; I think it's safe to say
most people using Zope with FastCGI are already using 2.2 and just
have not discovered this issue.  Probably, it's even already been
discussed there, and someone decided not to fix it.  But that's
just speculation.

--=20
Matt Behrens <matt@zigg.com> <URL:http://zigg.com/>

--RASg3xLB4tUQ4RcS
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9YR1z+xq4JbgNGlMRAivcAJ0X1Snm1YfWhqUUMxHwqm4YUgmzgACgimfE
MlS4hK1lH+lporgoTRSEVxk=
=67J5
-----END PGP SIGNATURE-----

--RASg3xLB4tUQ4RcS--