Spoofing AUTH_USER or REMOTE_USER

Thank you for the responses, this is really good information.  Much appreciated!

The only CGI variables that can be "spoofed" by the browser are those that (a) come directly from the browser, like HTTP_USER_AGENT, and (b) won't prevent the browser from receiving a response. Most of these begin with "HTTP_". Other CGI variables, like AUTH_USER, don't come from the browser, but instead come from the web server and/or CF itself.

Dave Watts, CTO, Fig Leaf Software

http://www.figleaf.com/

http://training.figleaf.com/

Fig Leaf Software is a Veteran-Owned Small Business (VOSB) on

GSA Schedule, and provides the highest caliber vendor-authorized

instruction at our training centers, online, or onsite.

Read this before you post:

http://forums.adobe.com/thread/607238

The first thing to note is that the AUTH_USER and REMOTE_USER have nothing to do with the Windows Integrated Authentication AKA NTLM authentication process.  They are provided by the web server AFTER the NTML authentication process has been completed.

The actual NTLM authentication process goes something like this.

Client requests resource protected by NTLM on the web server.

The web server responds to the client with a 401.1 HTTP response asking for the user.

If the client understands this, it responds with the user.

The web server responds to the client with a 401.2 HTTP response asking for the password.

The client responds with the password (or something the represents it).

If the web server can validate these creditionals, it responds with an 200 HTTP response with the requested resource.  At this point it will populate the CGI variables with values such as AUTH_USER and REMOTE_USER.

I am sure there are possible attack vectors that can allow unintended access through the NTLM protection.  There is no such thing as 100% guaranteed security.  But spoofing the AUTH_USER shouldn't matter.