# Why to have owner's uid of the file when WWW-Authenticate header?

- Thread: https://externals.io/message/12934
- Original archive: https://news-web.php.net/php.internals/12934
- Started by Kamesh Jayachandran on 2004-09-22T14:34:09+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #12934 — Kamesh Jayachandran — 2004-09-22T14:34:09+00:00

URL: https://externals.io/message/12934#12934

Hi All,

I want to know the reason behind the having the uid of the owner of the
file shown as a part of realm string the WWW-Authenticate when safe_mode
is enabled.


With regards
Kamesh Jayachandran

---

## #12941 — Uwe Schindler — 2004-09-22T21:26:28+00:00

URL: https://externals.io/message/12934#12941 · In reply to: #12934

Something additional to this:
I am fixing bug #29805 (HTTP Authentication Issues in NSAPI).

Copied from some other SAPIs I have done this by adding of the following line:

         if (!PG(safe_mode)) 
php_handle_auth_data(pblock_findval("authorization", rq->headers) TSRMLS_CC);

The problem is: Apache disables this in safe mode only if some other 
authentication (like .htaccess) is active. In NSAPI you cannot check this, 
so I disabled the whole authentication in NSAPI. Other SAPIs do not check 
for safe mode.

What is the background of disabling of passing the headers "Authentication" 
and the user/password pairs in it to the user? Is it a problem to simply 
give the user access to this information (even with safe mode) - If there 
is some authentication by .htaccess or something other it is normally from 
the same user that wrote the script.

Uwe

At 16:34 22.09.2004, you wrote:
>Hi All,
>
>I want to know the reason behind the having the uid of the owner of the
>file shown as a part of realm string the WWW-Authenticate when safe_mode
>is enabled.
>
>
>With regards
>Kamesh Jayachandran
>
>--
>
>

-----
Uwe Schindler
thetaphi@php.net - http://www.php.net
NSAPI SAPI developer
Erlangen, Germany

---

## #12942 — Rasmus Lerdorf — 2004-09-23T01:17:41+00:00

URL: https://externals.io/message/12934#12942 · In reply to: #12941

> What is the background of disabling of passing the headers "Authentication"
> and the user/password pairs in it to the user? Is it a problem to simply
> give the user access to this information (even with safe mode) - If there
> is some authentication by .htaccess or something other it is normally from
> the same user that wrote the script.

Normally, sure.  But say on a shared host http://www.isp.com/~bob sets up
a password-protected page.  Then Tom comes along and wants to grab the
user ids and passwords from Bob's site.  Safe-mode is enabled so he can't
simply write a script to steal the passwords, and even if he could, they
are encrypted.  So the way to hack it is to just password protect one of
his own pages and give it the same auth domain as Bob's pages and anybody
who visits http://www.isp.com/~tom anytime after visiting /~bob will
invisibly send their auth data to Tom.

-Rasmus