> Hi all,
>
> I was wondering if the wsgi var REMOTE_USER is always being set.
> Even if no user is authenticated, then it is set to "".
>
> I came across a strange problem, when my Python app using
> repoze.who works on Apache and mod_wsgi but stops working
> when running on Apache mod_uwsgi --> uwsgi. (by not working
> I mean that repoze.who seemed to be completely by-passed).
>
> Which I later realized was caused by a condition in repoze.who
> middleware:
>         if self.remote_user_key in environ:
>             # act as a pass through if REMOTE_USER (or whatever) is
>             # already set
>             return self.app(environ, start_response)
>
> Still it seems incredible to me that I am the first one to hit this issue.
> What do you guys think? Is there a bug in mod_uwsgi, or repoze.who,
> or am I missing something?


http://www.ietf.org/rfc/rfc3875

4.1.11

Assuming an authentication attempt checking only for REMOTE_USER is wrong
as it could be empty

In the mod_uwsgi specific case:

vecptr = uwsgi_add_var(uwsgi_vars, vecptr, r, "REMOTE_USER", r->user ?
r->user : "", &pkt_size) ;

the same apply to mod_scgi

I do not pretend repoze.who to change its behaviour (mainly because the
CGI specs are unclear), so it is better to you to add a WSGI middleware
doing something like this:

if environ['REMOTE_USER'] == '':
    del(environ['REMOTE_USER'])

-- 
Roberto De Ioris
http://unbit.it
_______________________________________________
uWSGI mailing list
[email protected]
http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi

Reply via email to