CODEWITHSUNDEEP
iiscoldfusionrailoopenbd
Goyuix
Goyuix

Reputation: 24370

Difference between AUTH_USER and REMOTE_USER cgi variables

The docs aren't entirely clear on this - is there a difference between these variables? On IIS at least they appear to be identical, but I don't want to rely on that if it might be different under other servers.

Upvotes: 7

Views: 9403

Answers (5)

Ryan Stille
Ryan Stille

Reputation: 1364

REMOTE_USER and AUTH_USER will be the same in AdobeCF/IIS, but not on AdobeCF/Apache. AUTH_USER will be blank when using AdobeCF/Apache.

So it is best to code using the REMOTE_USER variable. If you find yourself working on code that references AUTH_USER in Apache, there is a way to make Apache populate that variable using mod_rewrite. This will cause Apache to copy REMOTE_USER into AUTH_USER:

RewriteEngine on RewriteCond %{REMOTE_USER} (.) RewriteRule . - [E=AUTH_USER:%1]

There is more info here: http://www.stillnetstudios.com/copying-env-variables-in-apache/

Upvotes: 4

LucasS
LucasS

Reputation: 461

to be on the safe side stick to REMOTE_USER as it is the one defined in the CGI/1.0 spec (Found here http://www.ietf.org/rfc/rfc3875)

AUTH_USER seems to have snuck in over time

Upvotes: 2

Adam Tuttle
Adam Tuttle

Reputation: 19834

In my experience, CGI variables tend to differ between Web Servers (Apache, IIS, JRun, etc), and even between their versions. The only safe bet, when basing something on a CGI variable, is to check what values show up on your dev, stage, production (etc) servers.

Upvotes: 1

Jayson
Jayson

Reputation: 2031

According to the Adobe ColdFusion documentation they are the same.

http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Expressions_8.html

Looking at the openbd source code, the remote_user and the auth_user are mapped to the same key, so it returns the same value.

Looking at the railo source code, I'm not quite understanding what is going on, but it appears to be setting remote_user, and I'm not sure if auth_user is being set anywhere.

If you are designing an app that is compatible with coldfusion, railo, and openbd, it appears safer to use remote_user. Maybe someone else can comment because I don't fully understand the code without taking the time to investigate deeply.

Upvotes: 8

Peter Boughton
Peter Boughton

Reputation: 112230

I'm fairly sure REMOTE_USER is the standard CGI variable.

According to this page, they are the same: http://livedocs.adobe.com/coldfusion/6/CFML_Reference/Expressions5.htm

Upvotes: 2

Related Questions