> Hi all, > > I was wondering if the wsgi var REMOTE_USER is always being set. > Even if no user is authenticated, then it is set to "". > > I came across a strange problem, when my Python app using > repoze.who works on Apache and mod_wsgi but stops working > when running on Apache mod_uwsgi --> uwsgi. (by not working > I mean that repoze.who seemed to be completely by-passed). > > Which I later realized was caused by a condition in repoze.who > middleware: > if self.remote_user_key in environ: > # act as a pass through if REMOTE_USER (or whatever) is > # already set > return self.app(environ, start_response) > > Still it seems incredible to me that I am the first one to hit this issue. > What do you guys think? Is there a bug in mod_uwsgi, or repoze.who, > or am I missing something?
http://www.ietf.org/rfc/rfc3875 4.1.11 Assuming an authentication attempt checking only for REMOTE_USER is wrong as it could be empty In the mod_uwsgi specific case: vecptr = uwsgi_add_var(uwsgi_vars, vecptr, r, "REMOTE_USER", r->user ? r->user : "", &pkt_size) ; the same apply to mod_scgi I do not pretend repoze.who to change its behaviour (mainly because the CGI specs are unclear), so it is better to you to add a WSGI middleware doing something like this: if environ['REMOTE_USER'] == '': del(environ['REMOTE_USER']) -- Roberto De Ioris http://unbit.it _______________________________________________ uWSGI mailing list [email protected] http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
