CGI/1.1 draft

• Mail folder: WWW Talk Jan 94-present
• Next message: Martijn Koster: "Re: The future of meta-indices/libraries? "
• Previous message: Rob McCool: "Re: CGI/1.1 draft"
• Maybe in reply to: Rob McCool: "Re: CGI/1.1 draft"
• Reply: George Phillips: "Re: CGI/1.1 draft"

Errors-To: listmaster@www0.cern.ch
Date: Wed, 16 Mar 1994 08:02:16 --100
Message-id: <9403160700.AA22641@moulon.moulon.inra.fr>
Errors-To: listmaster@www0.cern.ch
Reply-To: decoux@moulon.inra.fr
Originator: www-talk@info.cern.ch
Sender: www-talk@www0.cern.ch
Precedence: bulk
From: decoux@moulon.inra.fr (ts)
To: Multiple recipients of list <www-talk@www0.cern.ch>
Subject: CGI/1.1 draft
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas
Content-Length: 998

> While Accept:, Content-Type: and Content-Length: are literally in
> the CGI variable space, only a munged version of Authorized: is
> there.  How about changing that to "does not include Authorized:
> if server is doing the authentication on that script, otherwise
> is does."  For a script with simple authorization requirements,
> the server can do the work.  When the script gateways into something
> where server authentication is inappropriate or impossible
> (like an Oracle database), the writer can use an "nph-" script and
> do the authentication herself.
> 

 Why server authentication is impossible with an Oracle database ?

 Actually, when I consult an Oracle database server make authentication and
call the script with the process uid of the authenticated user. Script use
only process uid (and no password) to open the database, i.e. (in Perl) :

      &ora_login($database,'/','');

 Script don't make authentication but check only the real access to the
database.

Guy Decoux