The difference between the variables AUTH_USER and REMOTE_USER cgi

Question

The docs are not entirely clear on this - is there a difference between these variables? In IIS, at least they seem the same, but I don't want to rely on this if they can be different from other servers.

Answer 1

According to the Adobe ColdFusion documentation, they are the same.

http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Expressions_8.html

After looking at the openbd source code, remoteuser and auth_user are mapped to the same key, so it returns the same value.

Looking at the source code for railo, I don’t quite understand what is happening, but it seems to be a remote_user setting, and I'm not sure if auth_user is installed anywhere.

If you are developing an application compatible with coldfusion, railo, and openbd, it is safer to use remote_user. Maybe someone can comment, because I do not quite understand the code without wasting time on in-depth research.

Answer 2

REMOTE_USER and AUTH_USER will be the same in AdobeCF / IIS, but not on AdobeCF / Apache. When using AdobeCF / Apache, AUTH_USER will be empty.

Therefore, it is best to use the code REMOTE_USER. If you find yourself working on code that references AUTH_USER in Apache, there is a way to make Apache populate this variable with mod_rewrite. This will force Apache to copy REMOTE_USER to AUTH_USER:

RewriteEngine on RewriteCond% {REMOTE_USER} (.) RewriteRule. - [E = AUTH_USER:% 1]

Here's more info: http://www.stillnetstudios.com/copying-env-variables-in-apache/

Answer 3

I am sure that REMOTE_USER is a standard CGI variable.

According to this page, they are the same: http://livedocs.adobe.com/coldfusion/6/CFML_Reference/Expressions5.htm

Answer 4

to be safe, stick to REMOTE_USER, as defined in the CGI / 1.0 specification (found here http://www.ietf.org/rfc/rfc3875 )

AUTH_USER seems to have slipped over time

Answer 5

In my experience, CGI variables tend to differ between web servers (Apache, IIS, JRun, etc.) and even between their versions. The only safe bet when using something in a CGI variable is to check what values ​​are displayed on the dev, stage, production (etc) servers.