Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <49C3CF1E.4090609@rowe-clan.net>
Date: Fri, 20 Mar 2009 18:15:10 +0100
From: "William A. Rowe, Jr." <wrowe@rowe-clan.net>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: test framework/mod_authany's check user id hook vs. mod_ssl's
References: <cc67648e0903191336j427d0f5er6059e64abdcd3432@mail.gmail.com>
 <20090320162518.GA9478@redhat.com>
In-Reply-To: <20090320162518.GA9478@redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Joe Orton wrote:
> On Thu, Mar 19, 2009 at 04:36:42PM -0400, Jeff Trawick wrote:
>> Beyond the mod_authany question, why doesn't mod_ssl declare its check user
>> id hook really-first if it can generate the basic auth?  (Let the extremely
>> limited number of modules which generate basic auth headers fight it out via
>> predecessor/successor lists.)
> 
> I doubt much thought has gone into it.
> 
> Since, as you say, all the FakeBasic code needs to happen before the 
> real check_user_id hooks run, I'd reckon it would make more sense to 
> move it to e.g. the post_read_request hook (ssl_hook_ReadReq), rather 
> than trying harder to win the hook ordering game?

For that matter, why does SSLRequire still exist?  Has nothing to do at
all with SSL ;-)  Perhaps it's time to start doing what Mr Laurie wanted
to accomplish in the first place, and (saving functionality elsewhere)
pare mod_ssl to the bone of what it is meant to do?  socache was a good
start, obviously :)