Re: broken Digest auth

On Tue, 2003-11-25 at 00:51, Ben Collins-Sussman wrote:
> Anyone have any thoughts?

It sounds like either subrequests aren't a great mechanism for checking
authorization, or perhaps the subrequest system isn't architected right
(the subrequest should not be authenticated separately from the main
request). Not sure which.

I see three options:

  * Hack around this problem. In addition to being ugly and a layer
violation, this option leaves open the possibility that there might be
another authentication system in the future where we simply can't
rewrite the authentication headers--say, because it involves the client
signing the entire request using a private key, and we only have the
public key.

  * Get an enhancement into Apache, where you can tell a subrequest to
pull its authentication from the main request, instead of processing the
WWW-Authorization header.

  * Abandon mod_authz_svn, and build authorization checks into
mod_dav_svn. As far as the Apache configuration is concerned, don't
pretend that a checkout involves authorizing GET requests.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Nov 25 07:21:41 2003