alexander.elg...@t-systems.com wrote:
Thank you, it works.
------------------------------------------------------------------------------
# http://perl.apache.org/docs/2.0/api/Apache2/RequestRec.html
use CGI;
#use Apache ();
#use APR::Base64;
use Apache2::Access ();
use Apache2::RequestRec ();
use Apache2::RequestUtil ();
my $q = CGI->new;
#print $ENV{MOD_PERL_API_VERSION} . "\n";
#my $r = Apache->request();
my $r = Apache2::RequestUtil->request(); #httpd.conf # get the global request
object (requires PerlOptions +GlobalRequest)
$pw = $r->headers_in->{Authorization};
#$pw =~ s/^Basic //;
#$pw = APR::Base64::decode($pw);
print $q->header();
#print "Apache->request: ". $pw . "<br>\n";
(my $rc, $pw)=$r->get_basic_auth_pw;
print "Apache2 Access get_basic_auth_pw: " . $pw . "<br>\n";
----------------------------------------------------------------------------------
There you go.
About all the rest, and the obviously unwelcome comments you got before :
Your initial post was very short on details, and sounded like you thought that being able
to get the user's password after a web authentication was a universal truth, via a cgi-bin
"HTTP_AUTHORIZATION" environment value.
That, and you reference to a one-line PHP script command, frankly made it sound like
something coming from a "script-kiddie".
That is why you got these comments related to security, authentication methods,
SSL etc..
HTTP headers of a request are not normally available to a cgi-bin script.
CGI environment values are only there if the httpd server (or some other add-on module)
puts them there before running the script. Some of these environment values may be derived
from original HTTP request headers, but the relationship is not one-to-one.
The user's authentication password is certainly not contained in any standard CGI
environment value.
The user's authentication password is only available from a HTTP request header, if the
web authentication method used is HTTP Basic Authentication. In all other serious web
authentication methods, the password is not transmitted over the net, encrypted or not.
So it is generally not possible for anything running in a webserver, to get to that
password in clear; and rightly so, because people tend to use the same password for any
2-cent web application, as they use to login to their corporate servers.
In other words, if you build your application on the premise that you can get and use the
user's password to encrypt something with it, then your application will not be portable
to any serious context.
Also, if your application has parts running under SSL and parts that don't, then as a
whole it is as insecure as the non-SSL part. It is the weakest part that determines the
security level, not the strongest part.
The same about implementing security "step by step". If you start running your
application insecurely, then by the time you make it secure, the user's passwords will
already have been stolen, and can be re-used in the secure version. Are all users going
to change their passwords then ?
In summary, the code above is good as an exercise for mod_perl. Is it recommended for any
real application ? certainly not.
Believe it or not, people on this list are only trying to help you, for example in not
writing code that you'll have to rewrite later.
