3 ms·
Does FastCGI have a history of security bugs due to environment var / header confusion or just regular CGI?
by earthboundkid 6y ago
Does FastCGI have a history of security bugs due to environment var / header confusion or just regular CGI?
- dsign 6y agoYes, just as CGI. For example, the HTTP header Proxy may be converted to "HTTP_PROXY" and some application servers may interpret it as the environment variable HTTP_PROXY (I seem to remember HHVM did it). Good servers have measures in place to handle that header, but it can bite you if you are implementing a new server.
- neopallium 6y agoFastCGI doesn't set environment variables. Only CGI does that since the CGI binary is executed for each request. FastCGI binaries run as a server listening on a unix/tcp socket for connections from the frontend web server. It works the like a webapp listening for http requests on a local socket with reverse http proxy rules setup on the frontend web server.
- jasonjayr 6y agoFastCGI transmits the headers via its protocol socket and doesn't rely on environment variable mechanisms to transmit them. Some fcgi libraries may convert the headers into Env Vars to make it "easier" for code, but it is not strictly necessary.
- user5994461 6y agoYes. Both have the same issue since it's the same thing. CGI starts one process per request, FastCGI reuse a process for more requests to improve performance.