> >I don't see a point in modifying the core to also parse Authentication: >Digest headers. I think Ns_SetRequestAuthorizeProc should be ripped >out and replaced with a new filter type, "auth". Auth filters should >simply be run after preauth filters and before postauth filters. I don't >see any advantage in the current, completely separate mechanism for >authorization.
That sound like a great idea, there is quite an abyss between pre and post, so that most hacks at new services put authorization into a preauth filter. It seems like this part of the core is cleanly written so it would be relatively obvious what to do. I think aD decided that there was no useful distinction, and a better scheme would be a global ordering of filters instead of the "I got here first" method, which ends up being a nightmare for follow-up developers. Still there must be a reason for the distinction in the original design, and extending that seems useful. --Tom Jackson
