Subject: SSI vs CGI

From: "Zvi Har'El" <[email-masked]>
Date: Sun, 3 Feb 2002 00:02:12 +0200 (IST)

Friends,

I compared the environment variables I get in an SSI, like <!--#printenv-->,
and a CGI, running a script like

#!/usr/local/bin/zsh -x
echo "Content-type: text/plain"
echo
printenv

In an HTTPS virtual host, there are many variables that are exported one
method and not the other: More specifically, all the variables starting with
SSL_ (e.g., SSL_CIPHER, SSL_SESSION_ID, etc.), are exported to the CGI script,
but are not printed by the printenv SSI. This is in Apache/2.0.32-dev (Unix)
mod_ssl/3.0a0 OpenSSL/0.9.6b (which I compiled from the latest CVS).

I didn't notice an opposite problem in this version of Apache, but in another
version - in the latest RedHat distro, which is Apache 1.3.22. I didn't see the
problem in 1.3.23 in Solaris: The variable assignment HTTPS=on, which appears
in a HTTPS virtual host in the <!--#printenv--> output, is not exported to the
CGI script! (The SSL_ variables are not exported in 1.3). I didn't try to
install vanilla 1.3.23 on RedHat, ao I don't know what is the origin of the
problem. If I have more specific info I'll post it.

Best,

Zvi.

-- 
Dr. Zvi Har'El     mailto:[email-masked]     Department of Mathematics
tel:+972-54-227607                   Technion - Israel Institute of Technology
fax:+972-4-8324654 http://www.math.technion.ac.il/~rl/     Haifa 32000, ISRAEL
"If you can't say somethin' nice, don't say nothin' at all." -- Thumper (1942)
                           Saturday, 21 Shevat 5762,  2 February 2002, 11:37PM
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Thomas Binder <[email-masked]>
Date: Mon, 4 Feb 2002 15:26:36 +0100

Hi!

On Sun, Feb 03, 2002 at 12:02:12AM +0200, Zvi Har'El wrote:
> In an HTTPS virtual host, there are many variables that are
> exported one method and not the other: More specifically, all
> the variables starting with SSL_ (e.g., SSL_CIPHER,
> SSL_SESSION_ID, etc.), are exported to the CGI script, but are
> not printed by the printenv SSI. This is in Apache/2.0.32-dev
> (Unix) mod_ssl/3.0a0 OpenSSL/0.9.6b (which I compiled from the
> latest CVS).

Take a look in the F.A.Q.:

http://www.modssl.org/docs/2.8/ssl_faq.html#ToC22

Ciao

Thomas

-- 
There's no time like the pleasant.