httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jim Jagielski <...@jaguNET.com>
Subject Re: mod_status and not displaying the password in request
Date Fri, 30 Oct 1998 13:30:55 GMT
Rasmus Lerdorf wrote:
> 
> > I'd really like to avoid Yet Another runtime directive that controls
> > this, but I think this capability should be the default. After all,
> > there is "lots" of sensitive data presented in the server-status
> > display, and no one should really be allowing the world to see what's
> > going on.
> 
> What other sensitive information is there?  
> 

Well, I consider things like the client's IP and the vhost itself
"sensitive" information. Heck, even the request itself could be
considered sensitive in that why should the world know that the
browser at 207.207.111.2 was looking at 'www.biguns.com' and requesting
'GET /images/whatknockers.gif HTTP/1.0'

:) :) :)

-- 
===========================================================================
   Jim Jagielski   |||   jim@jaguNET.com   |||   http://www.jaguNET.com/
            "That's no ordinary rabbit... that's the most foul,
            cruel and bad-tempered rodent you ever laid eyes on"

Mime
View raw message