wrote Authen module dealing with cookies : now POST requests get corrupted. Any advice ?

wrote Authen module dealing with cookies : now POST requests get corrupted. Any advice ?

am 20.06.2008 08:27:34 von laurent.dami

This is a multi-part message in MIME format.

------_=_NextPart_001_01C8D29E.BA24C48E
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi everybody,

I recently wrote an extension to Apache2::AuthenNTLM in order to store
the NTLM authentified username in a cookie (module
http://search.cpan.org/dist/Apache2-AuthenNTLM-Cookie/).=20

Now I found out that this module has a critical bug : the content of
POST requests gets corrupted (bug
http://rt.cpan.org/Ticket/Display.html?id=3D36847).

I don't really know where to start to fix the bug. My hypothesis is that
perhaps this is because I'm using Apache2::Cookie, which itself uses
libaprequest, and maybe these modules are not meant to be used in an
early Apache phase, and leave the input stream in an buggy state. I
looked at a couple of other authentication modules using cookies, but
they don't seem to use the Apache2::Cookie API.

Is that the hypothesis correct ? Does anybody have good advice on that
problem ?=20

Thanks in advance,=20

Laurent Dami


------_=_NextPart_001_01C8D29E.BA24C48E
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable




charset=3Dus-ascii">
6.5.7652.24">
wrote Authen module dealing with cookies : now POST requests get =<br /> corrupted. Any advice ?




Hi everybody,



I recently wrote  an extension to =
Apache2::AuthenNTLM in order to store the NTLM authentified username in =
a cookie (module
HREF=3D"http://search.cpan.org/dist/Apache2-AuthenNTLM-Cooki e/"> COLOR=3D"#0000FF" SIZE=3D2 =
FACE=3D"Arial">http://search.cpan.org/dist/Apache2-AuthenNTL M-Cookie/ NT>
).



Now I found out that this module has a =
critical bug : the content of POST requests gets corrupted (bug =
HREF=3D"http://rt.cpan.org/Ticket/Display.html?id=3D36847"> COLOR=3D"#0000FF" SIZE=3D2 =
FACE=3D"Arial">http://rt.cpan.org/Ticket/Display.html?id=3D3 6847
U>
).



I don't really know where to start to =
fix the bug. My hypothesis is that perhaps this is because I'm using =
Apache2::Cookie, which itself uses libaprequest, and maybe these modules =
are not meant to be used in an early Apache phase, and leave the input =
stream in an buggy state. I looked at a couple of other authentication =
modules using cookies, but they don't seem to use the Apache2::Cookie =
API.



Is that the hypothesis correct ? Does =
anybody have good advice on that problem ?



Thanks in advance,



        FACE=3D"Arial">Laurent Dami





------_=_NextPart_001_01C8D29E.BA24C48E--

Re: wrote Authen module dealing with cookies : now POST requestsget corrupted. Any advice ?

am 21.06.2008 17:39:05 von Adam Prime

Dami Laurent (PJ) wrote:
> Hi everybody,
>
> I recently wrote an extension to Apache2::AuthenNTLM in order to store
> the NTLM authentified username in a cookie (module
> _http://search.cpan.org/dist/Apache2-AuthenNTLM-Cookie/_).
>
> Now I found out that this module has a critical bug : the content of
> POST requests gets corrupted (bug
> _http://rt.cpan.org/Ticket/Display.html?id=36847_).
>
> I don't really know where to start to fix the bug. My hypothesis is that
> perhaps this is because I'm using Apache2::Cookie, which itself uses
> libaprequest, and maybe these modules are not meant to be used in an
> early Apache phase, and leave the input stream in an buggy state. I
> looked at a couple of other authentication modules using cookies, but
> they don't seem to use the Apache2::Cookie API.
>
> Is that the hypothesis correct ? Does anybody have good advice on that
> problem ?

There is a lot of code on CPAN using libapreq and/or Apache2::Cookie in
every phase, so I very seriously doubt that that's a problem. The first
thing i'd do in your situation would be to make sure that the bug
doesn't exist in Apache2::AuthenNTLM, to confirm it's actually specific
to you're extention.

Telling us what exactly 'gets corrupted' means might help too (ie
error_log details, or whatever you're seeing).

Adam