title: FastCGI authorizer support in lighttpd broken?
body: <p>I'm in the process of writing a webapp in C++ using FastCGI with lighttpd.  The reason I'm doing this the painful way is because the end product will go on an embedded device.  Originally, I didn't know about FCGI modes; I thought everything was basically a responder.  Then I learned about authorizers, and I've been trying to enable support for it.</p>
  <p>Lighttpd seems to have no trouble putting an authorizer in front of static content, but when I try to protect another FCGI script it gives me 403 forbidden.</p>
  <p>I've done a lot of research, and come to some conclusions:</p>
  <ol>
  <li><a href="http://redmine.lighttpd.net/issues/322" rel="nofollow noreferrer" title="lighttpd site 1">Lighttpd's support</a> for the <a href="http://www.fastcgi.com/devkit/doc/fcgi-spec.html#S6.3" rel="nofollow noreferrer" title="fcgi spec">&quot;Variable-VAR_NAME: value&quot;</a> passing from authorizer to subsequent FCGIs is broken.</li>
  <li>The language in the first link implies that you <em>can</em> protect dynamic content with authorizers, but <a href="http://redmine.lighttpd.net/issues/321" rel="nofollow noreferrer" title="lighttpd site 2">this bug report</a> says otherwise.</li>
  </ol>
  <p>For the record, I'm using lighttpd 1.4.28 (x86 and ARM) and custom authentication (password hashed on client with SHA-512), because (1) TLS is impossible/unnecessary for this application, (2) basic HTTP authentication is not good enough, (3) digest authentication is broken in lighttpd, and (4) this isn't really intended to be a secure system anyway.</p>
  <p>Here's the relevant part of my lighttpd.conf file:</p>
  <pre><code>fastcgi.server = (
    &quot;main.fcgi&quot; =&gt;
      (( &quot;mode&quot;         =&gt; &quot;responder&quot;,
         &quot;bin-path&quot;     =&gt; &quot;/var/fcgi/main.fcgi&quot;,
         &quot;socket&quot;       =&gt; &quot;/tmp/fcgi.sock&quot;,
         &quot;check-local&quot;  =&gt; &quot;disable&quot;,
         &quot;max-procs&quot;    =&gt; 1
      )),
    &quot;/&quot; =&gt;
      (( &quot;mode&quot;         =&gt; &quot;authorizer&quot;,
         &quot;bin-path&quot;     =&gt; &quot;/var/fcgi/auth.fcgi&quot;,
         &quot;socket&quot;       =&gt; &quot;/tmp/fcgi.sock&quot;,
         &quot;check-local&quot;  =&gt; &quot;disable&quot;,
         &quot;max-procs&quot;    =&gt; 1,
         &quot;docroot&quot;      =&gt; &quot;/var/fcgi&quot;
      ))
  )
  </code></pre>
  <p>To wrap it up, can anyone give me guidance on using an FCGI authorizer to control access to other FCGI scripts(/binaries), instead of just static files, on lighttpd?  It would also be nice to get variable-passing working.  Thanks for reading this far!</p>