Apache Authorization header handling

[we...@esvax.dnet.dupont.com]

This is not a bug-report per se, but making a suggestion in the 
context of discussing implementation for Authorization of
cgi-programs.

Apache has choosen to only pass to a cgi program a portion of
the "Authorization" header, and then only when the cgi-program
is subject to Authorization checking due to the presense
of a file like '.htaccess' in the directory with the program.
Under thos conditions, the 'username' is passed to "REMOTE_USER", 
the password is not passed.  

I submit that an improved performance should be used:
in the case that an "Authorization" header is sent by the
client, but the target cgi-program is not subject to
Authorization checking, that the contents of the
"Authorization" header be placed into an environmental
variable "HTTP_AUTHORIZATION". 

Why, you ask?  This allows programs/scripts to assign and administer
usernames and passwords.  A client accessing the script
without an "Authorization" header is sent a 401 response
using an nph- script.

When they respond with an authorization header, the 
username and password are checked BY THE SCRIPT against
the group and password files (or DBM files).  In the
case that the username exists and the password matches, 
the script allows access to the restricted information.
In the case that the username does not exist, the 
username and password may be added to the authorization files.

This performance is not possible with the present handling
of the "Authorization" header.

The documentation I can find is hazy about what to do:

"In addition to these, the header lines received from the client, if any, 
are placed into the environment with the prefix HTTP_ followed by the 
header name. Any - characters in the header name are changed to _ 
characters. The server may exclude any headers which it has already 
processed, such as Authorization, Content-type, and Content-length. If
necessary, the server may choose to exclude any or all of these headers 
if including them would exceed any system environment limits. "

My reading of this would be that "may exclude" means that what I
suggest is reasonable.  Hey, after all, you pass "Content-length";
why not Authorization?



On that point, can someone tell me how to change the source code so that
the Authorization header is handed off to "HTTP_AUTHORIZATION"?
I can barely read C, and this is not clear to me in the cgi-module
source code.  I assume this is not passed off at some point because
it is handled as an exception, but where, where, where?

Thanks.  Regards, Mike West   mwest@nyx.net westmj@esvax.dnet.dupont.com


----- End Included Message -----