[Cppcms-users] pass security credentials using fcgi

[Markus R. <us...@ma...>]

Hello Group!

I have a rather general question about fcgi but I still post in this group 
because I am interested in a solution which plays nicely with cppcms.

One way to authenticate users is to have some authentication code within 
cppcms and keep the auth state within a session. The drawback of this is:
- you need to write the authentication yourself
- you need to have a (in the worst case redudant) passwd/shadow

Another way is to use authentication methods found within webservers.
I am interested in how those security credentials are passed using fcgi.
E.g. in nginx I found "fastcgi_pass_header Authorization;" and to pass the 
information if we are in a secure session "fastcgi_param HTTPS $https;".
I wonder if other webservers also have this feature?

Is there a standard for which environment variables should be declared and 
how they should behave? Are the implementations found in apache/lighttpd 
fcgi standard compliant?

It seems like AUTH_TYPE and REMOTE_USER should be set for this feature.
Cppcms seems to have convenience functions for those.
Unfortunately I could not find detailed information about these.

Is this approach used in practice?

I also could not find anything about authentification in
http://cppcms.com/wikipp/en/page/secure_programming


best regards
Markus