I was wondering for a long time why so few Web Applications use HTTP-Authenitcation. OK, I understand webdesigners want more control over the password input Layout and and I see the issues with “logging out” when using HTTP-Authentication but for many applications these both are not an issue. And password management in browsers for HTTP-Authentication is usually so much better. At least for me using Safari which uses Keychain for password management.
Today I tried to implement HTTP-Authentication in Webware and found out the hard way why so little Web Applications support HTTP-Authentication. The Apache Webserver deliberately tries to bar CGIs and the like from implementing HTTP-Authentication. The reasoning is that “user supplied” scripts might steal authentication credentials when the “system” is doing the authentication. Might be. But many apache deployments have no user supplied scripts at all – everything is controlled by the same entity so there is no reason not to thrust scripts with the authentication information.
You can change this behavior by setting SECURITY_HOLE_PASS_AUTHORIZATION when compiling apache.
If you can’t recompile apache you can work arround the problem by using mod_rewrite to add the missing information to the environment. For Example using Webware’s mod_webkit something like this should do:
WKServer localhost 8086
SetHandler webkit-handler
RewriteEngine On
RewriteRule /WK(.*) - [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},PT]
But the rewrite Rule should also work with CGIs and other modules.
If you are a apache module author you should make sure you pass the Authorization to your scripting code. ap_add_common_vars(r) and ap_add_cgi_vars(r); refuse to do. So you must retrieve the Authorization header via ap_table_get(r->headers_in, "Authorization") and pass it on.
I have created a patch for Webware 0.8.1 which implements this.
On the Application server site code would look like this:
import base64
def authorized(self):
httpAuth = self.request().environ().get('HTTP_AUTHORIZATION', \
self.request().environ().get('X-HTTP_AUTHORIZATION'))
if not httpAuth: return 0
authType, auth = httpAuth.split(' ', 1)
assert authType.lower() == 'basic', 'Only basic HTTP authentication'
name, password = base64.decodestring(auth.strip()).split(':', 1)
return self.authorizeUser(name, password)
[code based on Ian Bicking's]
When apache is recompiled HTTP_AUTHORIZATION is supplied. If you use the mod_rewrite or mod_webkit approach X-HTTP_AUTHORIZATION is used since apache doesn't allow it's internel variabled to be redefined.
For an overview of HTTP-Authentification with Webware and and different approach in solving the problem see the Webware Wiki.
Posted in c0re, make what_i_want --force --really-hard | No Comments »
