Re: -pass-headers

Actually ALL the headers are being passed to the underlying fastcgi 
program. There is, however, a slight difference when working with HTTP 
authorization data.
You shouldn't bother about it. In case your customers are claiming that 
something is wrong, perhaps, they could specify which "headers" are not 
being received.
Then it would be possible to make more thorough analysis.

Oh yes, and most of the "headers" are being stored as environment 
variables. E.g. accesible via getenv or similar function call (at least 
in C) (e.g. getenv("QUERY_STRING"), getenv("HTTP_REFERER") and whatever 
else..

cheers,
jancha

Joachim Durchholz wrote:

> Hi all,
>
> If this is the wrong list for this question, please point me in the 
> right direction.
>
> Question: How do I make sure that all "interesting" headers make it to 
> the FastCGI application?
>
> Background infos:
> Apache 2.0.49 + mod_fastcgi 2.4.0 (Standard by SuSE 9.1).
> Setup is for PHP, with these directives in the <VirtualHost> sections 
> of httpd.conf:
>    SuexecUserGroup web52 web52
>    FastCgiWrapper /usr/sbin/suexec2
>    FastCgiConfig -singleThreshold 1
>    AddHandler fastcgi-script fcgi fcg fpl
>    Action application/x-httpd-php /cgi-bin/php.fcgi
>    AddType application/x-httpd-php php php3 php4
>
> Here's the rub:
> We're a web hoster, and we don't really know (or care) what PHP 
> scripts our customers install. How do we make sure that all headers 
> that any script might ever need are passed through?
>
> I already know that -pass-header is part of the answer.
> Unfortunately, the mod_fastcgi documentation is extremely vague on the 
> topic: "allows passing through headers that are normally not passed 
> through". No mention of what the full list of headers is or where to 
> get it. No mention which headers are normally passed through, and 
> which instance is taken as the "normal case" when it comes to blocking 
> headers: Apache, mod_cgi, mod_fastcgi, the CGI protocol, the FastCGI 
> protocol.
>
> No wonder that the WWW is entirely confused on the issue, too.
> Most configurations have
>   -pass-header Authorization
> but a large proportion of pages recommends
>   -pass-header HTTP_AUTHORIZATION
> (Oh, I just found 
> http://www.manucorp.com/archives/php-bugs/200512/msg01226.php . It 
> seems to indicate that PHP ignores the headers and takes the 
> environment variable HTTP_AUTHORIZATION, up to and including at least 
> PHP 4.4.2RC1. Now I'm even more confused: an environment variable 
> isn't a header, but naming it with -pass-header will pass it on 
> regardless???)
>
> I also found these recommendations:
>   -pass-header Cookie
>   -pass-header If-Modified-Since
>   -pass-header User-Agent
> though it's pretty unclear to me whether these are passed through 
> normally or not...
>
>
> Answers anybody? Pointers to docs?
>
> Regards,
> Jo
>
>------------------------------------------------------------------------
>
>___________________________________
>fastcgi-developers mailing list
>http://fastcgi.com/fastcgi-developers/
>  
>

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/