SSI Broken in Apache 2.4.x when Basic Auth is used

Description

When using Basic Auth on a non shibboleth enabled web site, Server Side Includes no longer function. I attempted to mitigate this by using ShibDisable On in the directories that are affected, however that does not seem to fix these sites.

I will upload a trace of an affected web server.

Environment

CentOS 6.4 OpenSSL 1.0.1e

Activity

Scott Cantor 
December 2, 2013 at 5:06 PM

Closing on release.

Scott Cantor 
November 20, 2013 at 9:04 PM

This is the same issue as in the indexing case. The message implicates the same hole in the code that ran assuming the post-read hook would have run. All the hooks now guard themselves and force-create a per-request structure and attendant objects if Apache doesn't do the right things internally.

Scott Cantor 
June 27, 2013 at 5:02 PM

Feel free to send them to me direct, or in Dropbox or what have you.

I've tested every which way in the past with no problems, so I think I need the exact case to spend more time on it.

gibsonb@imsweb.com 
June 27, 2013 at 4:59 PM

Okay the setup is like this:

documentroot is /web/website/htdocs/
The file affected is at /web/website/htdocs/folder/index.html (my developers do not use the .shtml extension for some reason I get around this by using the XBitHack Full statement on sites where they intend to use SSI)

If they try to include a file at say /web/website/htdocs/otherfolder/footer.html it will generate an error like this:
shib_auth_checker found no per-request structure, referer: http://www.website.com/
unable to include "/footer.html" in parsed file /web/website/htdocs/folder/index.html, subrequest setup returned 500, referer: http://www.website.com/

I did run a trace but this was the only thing useful as you suggested.

If you would like non-redacted configs I could provide them, but would rather not put them in an open forum.

<VirtualHost website:80>
ServerName www.website.com
ShibCompatValidUser On
XBitHack Full
DocumentRoot /web/website/htdocs
<Directory /web/website/htdocs>
Options FollowSymlinks Includes
AllowOverride All
Include /web/configs/.htaccess
</Directory>
</VirtualHost>

Scott Cantor 
June 27, 2013 at 4:47 PM

Please attach complete examples of the configuration affected. A trace probably won't tell me anything, but won't hurt. Apache does no logging of the SSI mechanism, so I get nothing about what it's doing internally.

Duplicate

Details

Assignee

Reporter

Fix versions

Affects versions

Created June 27, 2013 at 4:42 PM
Updated December 2, 2013 at 5:06 PM
Resolved November 20, 2013 at 9:04 PM