perl CGI script env var problems REMOTE_USER

[johanfalkman]

Newbie on cgi/perl..

Made an inlog with .htaccess, when logged in and calling a cgi script in the url: on exlorer, working fine, REMOTE_USER=logged in user.
But when calling the same script from an website, the REMOTE_USER doesn't seem to exist, how is this possible??
Need to know the REMOTE_USER becuase going to write to file REMOTE_USER.txt.
The script is in the same folder as .htaccess and .htpasswd.
/Johan.

 

[tsdragon]

Many of the cgi environment variables are unreliable at best. If you are using basic authentication (.htaccess) you can try the following subroutine. It parses and decodes the HTTP_AUTHORIZATION variable (which seems to be more reliable) to get the logon info.

sub GetLogon {

my($authtype,$authstring) =
   split(' ', $ENV{'HTTP_AUTHORIZATION'});

return "unknown" unless $authtype =~ /basic/i;

# We COULD use the following two lines, but it would include
# a lot of code that we don't really need much.

#use MIME::Base64 ();
#$decoded = MIME::Base64::decode($encoded);

# The following code comes from perlfaq9

# remove non-base64 chars
$authstring =~ tr[A-Za-z0-9+/][]cd;
# convert to uuencoded format
$authstring =~ tr[A-Za-z0-9+/][ -_];
# compute length byte
$len = pack("c", 32 + 0.75*length($authstring));
# uudecode and print	
my $authstring = unpack("u", $len . $authstring);

# Now we have userid:password. Split off just the userid
my ($user,undef) = split(':', $authstring);

return $user;

} # GetLogon

Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.

 

[johanfalkman]

thanks for the tip,

But the problems remains, the sub function only returns "unknown",

my($authtype,$authstring) =
split(' ', $ENV{'http_AUTHORIZATION'});

return "unknown" unless $authtype =~ /basic/i;

So is the authtype not /basic/i ????, newbie on the subject so I quite don't get the point...

The script finds the REMOTE_USER if I point to the script directly in the Adress url: in explorer, but not if a website points to the url: ????

Regards /

Johan Falkman, desperate for help!!!!!

 

[tsdragon]

HTTP_AUTHORIZATION needs to be in ALL CAPS. Try printing out the value of $ENV{'HTTP_AUTHORIZATION'}. The first word should be 'basic', followed by the "encrypted" userid and password. If it's not basic the function above won't work. I use this in a couple of places on one web site on it works.

FYI: Basic authentication is what is used when you have a .htaccess file, and the browser pops up it's own window to prompt for the userid and password.

Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.