2007-02-11 14:52:07 +00:00
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
|
|
|
|
|
"http://www.w3.org/TR/REC-html40/loose.dtd">
|
|
|
|
|
<HTML>
|
|
|
|
|
<HEAD>
|
|
|
|
|
<TITLE>Common Gateway Interface - 1.1 *Draft 03* [http://cgi-spec.golux.com/draft-coar-cgi-v11-03-clean.html]
|
|
|
|
|
</TITLE>
|
|
|
|
|
<!--#if expr="$HTTP_USER_AGENT != /Lynx/" -->
|
|
|
|
|
<!--#set var="GUI" value="1" -->
|
|
|
|
|
<!--#endif -->
|
|
|
|
|
<LINK HREF="mailto:Ken.Coar@Golux.Com" rev="revised">
|
|
|
|
|
<LINK REL="STYLESHEET" HREF="cgip-style-rfc.css" TYPE="text/css">
|
|
|
|
|
<META name="latexstyle" content="rfc">
|
|
|
|
|
<META name="author" content="Ken A L Coar">
|
|
|
|
|
<META name="institute" content="IBM Corporation">
|
|
|
|
|
<META name="date" content="25 June 1999">
|
|
|
|
|
<META name="expires" content="Expires 31 December 1999">
|
|
|
|
|
<META name="document" content="INTERNET-DRAFT">
|
|
|
|
|
<META name="file" content="<draft-coar-cgi-v11-03.txt>">
|
|
|
|
|
<META name="group" content="INTERNET-DRAFT">
|
|
|
|
|
<!--
|
|
|
|
|
There are a lot of BNF fragments in this document. To make it work
|
|
|
|
|
in all possible browsers (including Lynx, which is used to turn it
|
|
|
|
|
into text/plain), we handle these by using PREformatted blocks with
|
|
|
|
|
a universal internal margin of 2, inside one-level DL blocks.
|
|
|
|
|
-->
|
|
|
|
|
</HEAD>
|
|
|
|
|
<BODY>
|
|
|
|
|
<!--
|
|
|
|
|
HTML doesn't do paper pagination, so we need to fake it out. Basing
|
|
|
|
|
our formatting upon RFC2068, there are four (4) lines of header and
|
|
|
|
|
four (4) lines of footer for each page.
|
|
|
|
|
|
|
|
|
|
<DIV ALIGN="CENTER">
|
|
|
|
|
<PRE>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Coar, et al. CGI/1.1 Specification May, 1998
|
|
|
|
|
INTERNET-DRAFT Expires 1 December 1998 [Page 2]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</PRE>
|
|
|
|
|
</DIV>
|
|
|
|
|
-->
|
|
|
|
|
<!--
|
|
|
|
|
The following weirdness wrt non-breaking spaces is to get Lynx
|
|
|
|
|
(which is barely TABLE-aware) to line the left/right justified
|
|
|
|
|
text up properly.
|
|
|
|
|
-->
|
|
|
|
|
<DIV ALIGN="CENTER">
|
|
|
|
|
<TABLE WIDTH="100%" CELLPADDING=0 CELLSPACING=0>
|
|
|
|
|
<TR VALIGN="TOP">
|
|
|
|
|
<TD ALIGN="LEFT">
|
|
|
|
|
INTERNET-DRAFT
|
|
|
|
|
</TD>
|
|
|
|
|
<TD ALIGN="RIGHT">
|
|
|
|
|
Ken A L Coar
|
|
|
|
|
</TD>
|
|
|
|
|
</TR>
|
|
|
|
|
<TR VALIGN="TOP">
|
|
|
|
|
<TD ALIGN="LEFT">
|
|
|
|
|
draft-coar-cgi-v11-03.{html,txt}
|
|
|
|
|
</TD>
|
|
|
|
|
<TD ALIGN="RIGHT">
|
|
|
|
|
IBM Corporation
|
|
|
|
|
</TD>
|
|
|
|
|
</TR>
|
|
|
|
|
<TR VALIGN="TOP">
|
|
|
|
|
<TD ALIGN="LEFT">
|
|
|
|
|
|
|
|
|
|
</TD>
|
|
|
|
|
<TD ALIGN="RIGHT">
|
|
|
|
|
D.R.T. Robinson
|
|
|
|
|
</TD>
|
|
|
|
|
</TR>
|
|
|
|
|
<TR VALIGN="TOP">
|
|
|
|
|
<TD ALIGN="LEFT">
|
|
|
|
|
|
|
|
|
|
</TD>
|
|
|
|
|
<TD ALIGN="RIGHT">
|
|
|
|
|
E*TRADE UK Ltd.
|
|
|
|
|
</TD>
|
|
|
|
|
</TR>
|
|
|
|
|
<TR VALIGN="TOP">
|
|
|
|
|
<TD ALIGN="LEFT">
|
|
|
|
|
|
|
|
|
|
</TD>
|
|
|
|
|
<TD ALIGN="RIGHT">
|
|
|
|
|
25 June 1999
|
|
|
|
|
</TD>
|
|
|
|
|
</TR>
|
|
|
|
|
</TABLE>
|
|
|
|
|
</DIV>
|
|
|
|
|
|
|
|
|
|
<H1 ALIGN="CENTER">
|
|
|
|
|
The WWW Common Gateway Interface
|
|
|
|
|
<BR>
|
|
|
|
|
Version 1.1
|
|
|
|
|
</H1>
|
|
|
|
|
|
|
|
|
|
<!--#include virtual="I-D-statement" -->
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="Abstract">
|
|
|
|
|
Abstract
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
The Common Gateway Interface (CGI) is a simple interface for running
|
|
|
|
|
external programs, software or gateways under an information server
|
|
|
|
|
in a platform-independent manner. Currently, the supported information
|
|
|
|
|
servers are HTTP servers.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
The interface has been in use by the World-Wide Web since 1993. This
|
|
|
|
|
specification defines the
|
|
|
|
|
"current practice" parameters of the
|
|
|
|
|
'CGI/1.1' interface developed and documented at the U.S. National
|
|
|
|
|
Centre for Supercomputing Applications [NCSA-CGI].
|
|
|
|
|
This document also defines the use of the CGI/1.1 interface
|
|
|
|
|
on the Unix and AmigaDOS(tm) systems.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Discussion of this draft occurs on the CGI-WG mailing list; see the
|
2007-03-20 11:30:28 +00:00
|
|
|
project Web page at
|
2007-02-11 14:52:07 +00:00
|
|
|
<SAMP><URL:<A HREF="http://CGI-Spec.Golux.Com/"
|
|
|
|
|
>http://CGI-Spec.Golux.Com/</A>></SAMP>
|
|
|
|
|
for details on the mailing list and the status of the project.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<!--#if expr="$GUI" -->
|
|
|
|
|
<H2>
|
|
|
|
|
Revision History
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
The revision history of this draft is being maintained using Web-based
|
|
|
|
|
GUI notation, such as struck-through characters and colour-coded
|
|
|
|
|
sections. The following legend describes how to determine the origin
|
|
|
|
|
of a particular revision according to the colour of the text:
|
|
|
|
|
</P>
|
|
|
|
|
<DL COMPACT>
|
|
|
|
|
<DT>Black
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Revision 00, released 28 May 1998
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>Green
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Revision 01, released 28 December 1998
|
|
|
|
|
<BR>
|
|
|
|
|
Major structure change: Section 4, "Request Metadata (Meta-Variables)"
|
|
|
|
|
was moved entirely under <A HREF="#7.0">Section 7</A>, "Data Input to the
|
|
|
|
|
CGI Script."
|
|
|
|
|
Due to the size of this change, it is noted here and the text in its
|
|
|
|
|
former location does <EM>not</EM> appear as struckthrough. This has
|
|
|
|
|
caused major <A HREF="#6.0">sections 5</A> and following to decrement
|
|
|
|
|
by one. Other
|
|
|
|
|
large text movements are likewise not marked up. References to RFC
|
|
|
|
|
1738 were changed to 2396 (1738's replacement).
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>Red
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Revision 02, released 2 April, 1999
|
|
|
|
|
<BR>
|
|
|
|
|
Added text to <A HREF="#8.3">section 8.3</A> defining correct handling
|
|
|
|
|
of HTTP/1.1
|
|
|
|
|
requests using "chunked" Transfer-Encoding. Labelled metavariable
|
|
|
|
|
names in <A HREF="#8.0">section 8</A> with the appropriate detail section
|
|
|
|
|
numbers.
|
|
|
|
|
Clarified allowed usage of <SAMP>Status</SAMP> and
|
|
|
|
|
<SAMP>Location</SAMP> response header fields. Included new
|
|
|
|
|
Internet-Draft language.
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>Fuchsia
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Revision 03, released 25 June 1999
|
|
|
|
|
<BR>
|
|
|
|
|
Changed references from "HTTP" to "Protocol-Specific" for the listing of
|
|
|
|
|
things like HTTP_ACCEPT. Changed 'entity-body' and 'content-body' to
|
|
|
|
|
'message-body.' Added a note that response headers must comply with
|
|
|
|
|
requirements of the protocol level in use. Added a lot of stuff about
|
|
|
|
|
security (section 11). Clarified a bunch of productions. Pointed out
|
|
|
|
|
that zero-length and omitted values are indistinguishable in this
|
|
|
|
|
specification. Clarified production describing order of fields in
|
|
|
|
|
script response header. Clarified issues surrounding encoding of
|
|
|
|
|
data. Acknowledged additional contributors, and changed one of
|
|
|
|
|
the authors' addresses.
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
|
|
|
|
<!--#endif -->
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="Contents">
|
|
|
|
|
Table of Contents
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<DIV ALIGN="CENTER">
|
|
|
|
|
<PRE>
|
|
|
|
|
1 Introduction..............................................<A
|
|
|
|
|
HREF="#1.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
1.1 Purpose................................................<A
|
|
|
|
|
HREF="#1.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
1.2 Requirements...........................................<A
|
|
|
|
|
HREF="#1.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
1.3 Specifications.........................................<A
|
|
|
|
|
HREF="#1.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
1.4 Terminology............................................<A
|
|
|
|
|
HREF="#1.4"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
2 Notational Conventions and Generic Grammar................<A
|
|
|
|
|
HREF="#2.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
2.1 Augmented BNF..........................................<A
|
|
|
|
|
HREF="#2.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
2.2 Basic Rules............................................<A
|
|
|
|
|
HREF="#2.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
3 Protocol Parameters.......................................<A
|
|
|
|
|
HREF="#3.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
3.1 URL Encoding...........................................<A
|
|
|
|
|
HREF="#3.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
3.2 The Script-URI.........................................<A
|
|
|
|
|
HREF="#3.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
4 Invoking the Script.......................................<A
|
|
|
|
|
HREF="#4.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
5 The CGI Script Command Line...............................<A
|
|
|
|
|
HREF="#5.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6 Data Input to the CGI Script..............................<A
|
|
|
|
|
HREF="#6.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1 Request Metadata (Metavariables).......................<A
|
|
|
|
|
HREF="#6.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.1 AUTH_TYPE...........................................<A
|
|
|
|
|
HREF="#6.1.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.2 CONTENT_LENGTH......................................<A
|
|
|
|
|
HREF="#6.1.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.3 CONTENT_TYPE........................................<A
|
|
|
|
|
HREF="#6.1.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.4 GATEWAY_INTERFACE...................................<A
|
|
|
|
|
HREF="#6.1.4"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.5 Protocol-Specific Metavariables.....................<A
|
|
|
|
|
HREF="#6.1.5"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.6 PATH_INFO...........................................<A
|
|
|
|
|
HREF="#6.1.6"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.7 PATH_TRANSLATED.....................................<A
|
|
|
|
|
HREF="#6.1.7"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.8 QUERY_STRING........................................<A
|
|
|
|
|
HREF="#6.1.8"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.9 REMOTE_ADDR.........................................<A
|
|
|
|
|
HREF="#6.1.9"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.10 REMOTE_HOST........................................<A
|
|
|
|
|
HREF="#6.1.10"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.11 REMOTE_IDENT.......................................<A
|
|
|
|
|
HREF="#6.1.11"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.12 REMOTE_USER........................................<A
|
|
|
|
|
HREF="#6.1.12"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.13 REQUEST_METHOD.....................................<A
|
|
|
|
|
HREF="#6.1.13"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.14 SCRIPT_NAME........................................<A
|
|
|
|
|
HREF="#6.1.14"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.15 SERVER_NAME........................................<A
|
|
|
|
|
HREF="#6.1.15"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.16 SERVER_PORT........................................<A
|
|
|
|
|
HREF="#6.1.16"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.17 SERVER_PROTOCOL....................................<A
|
|
|
|
|
HREF="#6.1.17"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.1.18 SERVER_SOFTWARE....................................<A
|
|
|
|
|
HREF="#6.1.18"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
6.2 Request Message-Bodies................................<A
|
|
|
|
|
HREF="#6.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7 Data Output from the CGI Script...........................<A
|
|
|
|
|
HREF="#7.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.1 Non-Parsed Header Output...............................<A
|
|
|
|
|
HREF="#7.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2 Parsed Header Output...................................<A
|
|
|
|
|
HREF="#7.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.1 CGI header fields...................................<A
|
|
|
|
|
HREF="#7.2.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.1.1 Content-Type.....................................<A
|
|
|
|
|
HREF="#7.2.1.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.1.2 Location.........................................<A
|
|
|
|
|
HREF="#7.2.1.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.1.3 Status...........................................<A
|
|
|
|
|
HREF="#7.2.1.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.1.4 Extension header fields..........................<A
|
|
|
|
|
HREF="#7.2.1.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
7.2.2 HTTP header fields..................................<A
|
|
|
|
|
HREF="#7.2.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8 Server Implementation.....................................<A
|
|
|
|
|
HREF="#8.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.1 Requirements for Servers...............................<A
|
|
|
|
|
HREF="#8.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.1.1 Script-URI..........................................<A
|
|
|
|
|
HREF="#8.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.1.2 Request Message-body Handling.......................<A
|
|
|
|
|
HREF="#8.1.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.1.3 Required Metavariables..............................<A
|
|
|
|
|
HREF="#8.1.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.1.4 Response Compliance.................................<A
|
|
|
|
|
HREF="#8.1.4"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.2 Recommendations for Servers............................<A
|
|
|
|
|
HREF="#8.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
8.3 Summary of Metavariables...............................<A
|
|
|
|
|
HREF="#8.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
9 Script Implementation.....................................<A
|
|
|
|
|
HREF="#9.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
9.1 Requirements for Scripts...............................<A
|
|
|
|
|
HREF="#9.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
9.2 Recommendations for Scripts............................<A
|
|
|
|
|
HREF="#9.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
10 System Specifications....................................<A
|
|
|
|
|
HREF="#10.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
10.1 AmigaDOS..............................................<A
|
|
|
|
|
HREF="#10.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
10.2 Unix..................................................<A
|
|
|
|
|
HREF="#10.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11 Security Considerations..................................<A
|
|
|
|
|
HREF="#11.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11.1 Safe Methods..........................................<A
|
|
|
|
|
HREF="#11.1"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11.2 HTTP Header Fields Containing Sensitive Information...<A
|
|
|
|
|
HREF="#11.2"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11.3 Script Interference with the Server...................<A
|
|
|
|
|
HREF="#11.3"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11.4 Data Length and Buffering Considerations..............<A
|
|
|
|
|
HREF="#11.4"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
11.5 Stateless Processing..................................<A
|
|
|
|
|
HREF="#11.5"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
12 Acknowledgments..........................................<A
|
|
|
|
|
HREF="#12.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
13 References...............................................<A
|
|
|
|
|
HREF="#13.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
14 Authors' Addresses.......................................<A
|
|
|
|
|
HREF="#14.0"
|
|
|
|
|
>TBD</A>
|
|
|
|
|
</PRE>
|
|
|
|
|
</DIV>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="1.0">
|
|
|
|
|
1. Introduction
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="1.1">
|
|
|
|
|
1.1. Purpose
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Together the HTTP [<A HREF="#[3]">3</A>,<A HREF="#[8]">8</A>] server
|
2007-03-20 11:30:28 +00:00
|
|
|
and the CGI script are responsible
|
2007-02-11 14:52:07 +00:00
|
|
|
for servicing a client
|
|
|
|
|
request by sending back responses. The client
|
|
|
|
|
request comprises a Universal Resource Identifier (URI)
|
2007-03-20 11:30:28 +00:00
|
|
|
[<A HREF="#[1]">1</A>], a
|
2007-02-11 14:52:07 +00:00
|
|
|
request method, and various ancillary
|
|
|
|
|
information about the request
|
|
|
|
|
provided by the transport mechanism.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
The CGI defines the abstract parameters, known as
|
2007-02-11 14:52:07 +00:00
|
|
|
metavariables,
|
|
|
|
|
which describe the client's
|
|
|
|
|
request. Together with a
|
|
|
|
|
concrete programmer interface this specifies a platform-independent
|
|
|
|
|
interface between the script and the HTTP server.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="1.2">
|
|
|
|
|
1.2. Requirements
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
This specification uses the same words as RFC 1123
|
2007-03-20 11:30:28 +00:00
|
|
|
[<A HREF="#[5]">5</A>] to define the
|
2007-02-11 14:52:07 +00:00
|
|
|
significance of each particular requirement. These are:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<DL>
|
|
|
|
|
<DT><EM>MUST</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
This word or the adjective 'required' means that the item is an
|
|
|
|
|
absolute requirement of the specification.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><EM>SHOULD</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
This word or the adjective 'recommended' means that there may
|
|
|
|
|
exist valid reasons in particular circumstances to ignore this
|
|
|
|
|
item, but the full implications should be understood and the case
|
|
|
|
|
carefully weighed before choosing a different course.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><EM>MAY</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
This word or the adjective 'optional' means that this item is
|
|
|
|
|
truly optional. One vendor may choose to include the item because
|
|
|
|
|
a particular marketplace requires it or because it enhances the
|
|
|
|
|
product, for example; another vendor may omit the same item.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
|
|
|
|
<P>
|
|
|
|
|
An implementation is not compliant if it fails to satisfy one or more
|
|
|
|
|
of the 'must' requirements for the protocols it implements. An
|
|
|
|
|
implementation that satisfies all of the 'must' and all of the
|
|
|
|
|
'should' requirements for its features is said to be 'unconditionally
|
|
|
|
|
compliant'; one that satisfies all of the 'must' requirements but not
|
|
|
|
|
all of the 'should' requirements for its features is said to be
|
|
|
|
|
'conditionally compliant.'
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="1.3">
|
|
|
|
|
1.3. Specifications
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Not all of the functions and features of the CGI are defined in the
|
|
|
|
|
main part of this specification. The following phrases are used to
|
|
|
|
|
describe the features which are not specified:
|
|
|
|
|
</P>
|
|
|
|
|
<DL>
|
|
|
|
|
<DT><EM>system defined</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The feature may differ between systems, but must be the same for
|
|
|
|
|
different implementations using the same system. A system will
|
|
|
|
|
usually identify a class of operating-systems. Some systems are
|
|
|
|
|
defined in
|
|
|
|
|
<A HREF="#10.0"
|
|
|
|
|
>section 10</A> of this document.
|
|
|
|
|
New systems may be defined
|
|
|
|
|
by new specifications without revision of this document.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><EM>implementation defined</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The behaviour of the feature may vary from implementation to
|
|
|
|
|
implementation, but a particular implementation must document its
|
|
|
|
|
behaviour.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="1.4">
|
|
|
|
|
1.4. Terminology
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
This specification uses many terms defined in the HTTP/1.1
|
|
|
|
|
specification [<A HREF="#[8]">8</A>]; however, the following terms are
|
2007-03-20 11:30:28 +00:00
|
|
|
used here in a
|
2007-02-11 14:52:07 +00:00
|
|
|
sense which may not accord with their definitions in that document,
|
|
|
|
|
or with their common meaning.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<DL>
|
|
|
|
|
<DT><EM>metavariable</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
A named parameter that carries information from the server to the
|
|
|
|
|
script. It is not necessarily a variable in the operating-system's
|
|
|
|
|
environment, although that is the most common implementation.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<DT><EM>script</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The software which is invoked by the server <EM>via</EM> this
|
2007-03-20 11:30:28 +00:00
|
|
|
interface. It
|
2007-02-11 14:52:07 +00:00
|
|
|
need not be a standalone program, but could be a
|
|
|
|
|
dynamically-loaded or shared library, or even a subroutine in the
|
|
|
|
|
server. It <EM>may</EM> be a set of statements
|
|
|
|
|
interpreted at run-time, as the term 'script' is frequently
|
|
|
|
|
understood, but that is not a requirement and within the context
|
|
|
|
|
of this specification the term has the broader definition stated.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><EM>server</EM>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The application program which invokes the script in order to service
|
|
|
|
|
requests.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="2.0">
|
|
|
|
|
2. Notational Conventions and Generic Grammar
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="2.1">
|
|
|
|
|
2.1. Augmented BNF
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
All of the mechanisms specified in this document are described in
|
|
|
|
|
both prose and an augmented Backus-Naur Form (BNF) similar to that
|
|
|
|
|
used by RFC 822 [<A HREF="#[6]">6</A>]. This augmented BNF contains
|
|
|
|
|
the following constructs:
|
|
|
|
|
</P>
|
|
|
|
|
<DL>
|
|
|
|
|
<DT>name = definition
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The
|
|
|
|
|
definition by the equal character ("="). Whitespace is only
|
|
|
|
|
significant in that continuation lines of a definition are
|
|
|
|
|
indented.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>"literal"
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
Quotation marks (") surround literal text, except for a literal
|
|
|
|
|
quotation mark, which is surrounded by angle-brackets ("<" and ">").
|
|
|
|
|
Unless stated otherwise, the text is case-sensitive.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>rule1 | rule2
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
Alternative rules are separated by a vertical bar ("|").
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>(rule1 rule2 rule3)
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
Elements enclosed in parentheses are treated as a single element.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>*rule
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
A rule preceded by an asterisk ("*") may have zero or more
|
|
|
|
|
occurrences. A rule preceded by an integer followed by an asterisk
|
|
|
|
|
must occur at least the specified number of times.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT>[rule]
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
An element enclosed in square
|
|
|
|
|
brackets ("[" and "]") is optional.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="2.2">
|
|
|
|
|
2.2. Basic Rules
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The following rules are used throughout this specification to
|
|
|
|
|
describe basic parsing constructs.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
alpha = lowalpha | hialpha
|
|
|
|
|
alphanum = alpha | digit
|
|
|
|
|
lowalpha = "a" | "b" | "c" | "d" | "e" | "f" | "g" | "h"
|
|
|
|
|
| "i" | "j" | "k" | "l" | "m" | "n" | "o" | "p"
|
|
|
|
|
| "q" | "r" | "s" | "t" | "u" | "v" | "w" | "x"
|
|
|
|
|
| "y" | "z"
|
|
|
|
|
hialpha = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H"
|
|
|
|
|
| "I" | "J" | "K" | "L" | "M" | "N" | "O" | "P"
|
|
|
|
|
| "Q" | "R" | "S" | "T" | "U" | "V" | "W" | "X"
|
|
|
|
|
| "Y" | "Z"
|
|
|
|
|
digit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7"
|
|
|
|
|
| "8" | "9"
|
|
|
|
|
hex = digit | "A" | "B" | "C" | "D" | "E" | "F" | "a"
|
|
|
|
|
| "b" | "c" | "d" | "e" | "f"
|
|
|
|
|
escaped = "%" hex hex
|
|
|
|
|
OCTET = <any 8-bit sequence of data>
|
|
|
|
|
CHAR = <any US-ASCII character (octets 0 - 127)>
|
|
|
|
|
CTL = <any US-ASCII control character
|
|
|
|
|
(octets 0 - 31) and DEL (127)>
|
|
|
|
|
CR = <US-ASCII CR, carriage return (13)>
|
|
|
|
|
LF = <US-ASCII LF, linefeed (10)>
|
|
|
|
|
SP = <US-ASCII SP, space (32)>
|
|
|
|
|
HT = <US-ASCII HT, horizontal tab (9)>
|
|
|
|
|
NL = CR | LF
|
|
|
|
|
LWSP = SP | HT | NL
|
|
|
|
|
tspecial = "(" | ")" | "@" | "," | ";" | ":" | "\" | <">
|
|
|
|
|
| "/" | "[" | "]" | "?" | "<" | ">" | "{" | "}"
|
|
|
|
|
| SP | HT | NL
|
|
|
|
|
token = 1*<any CHAR except CTLs or tspecials>
|
|
|
|
|
quoted-string = ( <"> *qdtext <"> ) | ( "<" *qatext ">")
|
|
|
|
|
qdtext = <any CHAR except <"> and CTLs but including LWSP>
|
|
|
|
|
qatext = <any CHAR except "<", ">" and CTLs but
|
|
|
|
|
including LWSP>
|
|
|
|
|
mark = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
|
|
|
|
|
unreserved = alphanum | mark
|
|
|
|
|
reserved = ";" | "/" | "?" | ":" | "@" | "&" | "=" |
|
|
|
|
|
"$" | ","
|
|
|
|
|
uric = reserved | unreserved | escaped
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Note that newline (NL) need not be a single character, but can be a
|
|
|
|
|
character sequence.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="3.0">
|
|
|
|
|
3. Protocol Parameters
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="3.1">
|
|
|
|
|
3.1. URL Encoding
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Some variables and constructs used here are described as being
|
|
|
|
|
'URL-encoded'. This encoding is described in section
|
|
|
|
|
2 of RFC
|
|
|
|
|
2396
|
|
|
|
|
[<A HREF="#[4]">4</A>].
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
An alternate "shortcut" encoding for representing the space
|
|
|
|
|
character exists and is in common use. Scripts MUST be prepared to
|
|
|
|
|
recognise both '+' and '%20' as an encoded space in a
|
|
|
|
|
URL-encoded value.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Note that some unsafe characters may have different semantics if
|
|
|
|
|
they are encoded. The definition of which characters are unsafe
|
|
|
|
|
depends on the context.
|
|
|
|
|
For example, the following two URLs do not
|
|
|
|
|
necessarily refer to the same resource:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
http://somehost.com/somedir%2Fvalue
|
|
|
|
|
http://somehost.com/somedir/value
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
See section
|
|
|
|
|
2 of RFC
|
|
|
|
|
2396 [<A HREF="#[4]">4</A>]
|
|
|
|
|
for authoritative treatment of this issue.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="3.2">
|
|
|
|
|
3.2. The Script-URI
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The 'Script-URI' is defined as the URI of the resource identified
|
|
|
|
|
by the metavariables. Often,
|
2007-03-20 11:30:28 +00:00
|
|
|
this URI will be the same as
|
2007-02-11 14:52:07 +00:00
|
|
|
the URI requested by the client (the 'Client-URI'); however, it need
|
|
|
|
|
not be. Instead, it could be a URI invented by the server, and so it
|
|
|
|
|
can only be used in the context of the server and its CGI interface.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
The Script-URI has the syntax of generic-RL as defined in section 2.1
|
|
|
|
|
of RFC 1808 [<A HREF="#[7]">7</A>], with the exception that object
|
2007-03-20 11:30:28 +00:00
|
|
|
parameters and
|
2007-02-11 14:52:07 +00:00
|
|
|
fragment identifiers are not permitted:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
<scheme>://<host><port>/<path>?<query>
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The various components of the
|
|
|
|
|
Script-URI
|
|
|
|
|
are defined by some of the
|
|
|
|
|
metavariables (see
|
|
|
|
|
<A HREF="#4.0">section 4</A>
|
|
|
|
|
below);
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
script-uri = protocol "://" SERVER_NAME ":" SERVER_PORT enc-script
|
|
|
|
|
enc-path-info "?" QUERY_STRING
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
where 'protocol' is obtained
|
|
|
|
|
from SERVER_PROTOCOL, 'enc-script' is a
|
|
|
|
|
URL-encoded version of SCRIPT_NAME and 'enc-path-info' is a
|
|
|
|
|
URL-encoded version of PATH_INFO. See
|
|
|
|
|
<A HREF="#4.6">section 4.6</A> for more information about the PATH_INFO
|
|
|
|
|
metavariable.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Note that the scheme and the protocol are <EM>not</EM> identical;
|
|
|
|
|
for instance, a resource accessed <EM>via</EM> an SSL mechanism
|
|
|
|
|
may have a Client-URI with a scheme of "<SAMP>https</SAMP>"
|
|
|
|
|
rather than "<SAMP>http</SAMP>". CGI/1.1 provides no means
|
|
|
|
|
for the script to reconstruct this, and therefore
|
|
|
|
|
the Script-URI includes the base protocol used.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="4.0">
|
|
|
|
|
4. Invoking the Script
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
The
|
|
|
|
|
script is invoked in a system defined manner. Unless specified
|
|
|
|
|
otherwise, the file containing the script will be invoked as an
|
|
|
|
|
executable program.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="5.0">
|
|
|
|
|
5. The CGI Script Command Line
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
Some systems support a method for supplying an array of strings to
|
|
|
|
|
the CGI script. This is only used in the case of an 'indexed' query.
|
|
|
|
|
This is identified by a "GET" or "HEAD" HTTP request with a URL
|
|
|
|
|
query
|
|
|
|
|
string not containing any unencoded "=" characters. For such a
|
2007-03-20 11:30:28 +00:00
|
|
|
request,
|
2007-02-11 14:52:07 +00:00
|
|
|
servers SHOULD parse the search string
|
|
|
|
|
into words, using the following rules:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
search-string = search-word *( "+" search-word )
|
|
|
|
|
search-word = 1*schar
|
|
|
|
|
schar = xunreserved | escaped | xreserved
|
|
|
|
|
xunreserved = alpha | digit | xsafe | extra
|
|
|
|
|
xsafe = "$" | "-" | "_" | "."
|
|
|
|
|
xreserved = ";" | "/" | "?" | ":" | "@" | "&"
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
After parsing, each word is URL-decoded, optionally encoded in a
|
|
|
|
|
system defined manner,
|
|
|
|
|
and then the argument list is set to the list
|
|
|
|
|
of words.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
If the server cannot create any part of the argument list, then the
|
|
|
|
|
server SHOULD NOT generate any command line information. For example, the
|
|
|
|
|
number of arguments may be greater than operating system or server
|
|
|
|
|
limitations permit, or one of the words may not be representable as an
|
|
|
|
|
argument.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts SHOULD check to see if the QUERY_STRING value contains an
|
|
|
|
|
unencoded "=" character, and SHOULD NOT use the command line arguments
|
|
|
|
|
if it does.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="6.0">
|
|
|
|
|
6. Data Input to the CGI Script
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
Information about a request comes from two different sources: the
|
|
|
|
|
request header, and any associated
|
|
|
|
|
message-body.
|
|
|
|
|
Servers MUST
|
|
|
|
|
make portions of this information available to
|
|
|
|
|
scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="6.1">
|
|
|
|
|
6.1. Request Metadata
|
|
|
|
|
(Metavariables)
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Each CGI server
|
|
|
|
|
implementation MUST define a mechanism
|
2007-03-20 11:30:28 +00:00
|
|
|
to pass data about the request from
|
2007-02-11 14:52:07 +00:00
|
|
|
the server to the script.
|
|
|
|
|
The metavariables containing these
|
|
|
|
|
data
|
|
|
|
|
are accessed by the script in a system
|
2007-03-20 11:30:28 +00:00
|
|
|
defined manner.
|
2007-02-11 14:52:07 +00:00
|
|
|
The
|
|
|
|
|
representation of the characters in the
|
|
|
|
|
metavariables is
|
|
|
|
|
system defined.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
This specification does not distinguish between the representation of
|
|
|
|
|
null values and missing ones. Whether null or missing values
|
|
|
|
|
(such as a query component of "?" or "", respectively) are represented
|
|
|
|
|
by undefined metavariables or by metavariables with values of "" is
|
|
|
|
|
implementation-defined.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Case is not significant in the
|
|
|
|
|
metavariable
|
|
|
|
|
names, in that there cannot be two
|
|
|
|
|
different variables
|
|
|
|
|
whose names differ in case only. Here they are
|
|
|
|
|
shown using a canonical representation of capitals plus underscore
|
|
|
|
|
("_"). The actual representation of the names is system defined; for
|
|
|
|
|
a particular system the representation MAY be defined differently
|
|
|
|
|
than this.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Metavariable
|
|
|
|
|
values MUST be
|
|
|
|
|
considered case-sensitive except as noted
|
|
|
|
|
otherwise.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
The canonical
|
|
|
|
|
metavariables
|
|
|
|
|
defined by this specification are:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
AUTH_TYPE
|
|
|
|
|
CONTENT_LENGTH
|
|
|
|
|
CONTENT_TYPE
|
|
|
|
|
GATEWAY_INTERFACE
|
|
|
|
|
PATH_INFO
|
|
|
|
|
PATH_TRANSLATED
|
|
|
|
|
QUERY_STRING
|
|
|
|
|
REMOTE_ADDR
|
|
|
|
|
REMOTE_HOST
|
|
|
|
|
REMOTE_IDENT
|
|
|
|
|
REMOTE_USER
|
|
|
|
|
REQUEST_METHOD
|
|
|
|
|
SCRIPT_NAME
|
|
|
|
|
SERVER_NAME
|
|
|
|
|
SERVER_PORT
|
|
|
|
|
SERVER_PROTOCOL
|
|
|
|
|
SERVER_SOFTWARE
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Metavariables with names beginning with the protocol name (<EM>e.g.</EM>,
|
|
|
|
|
"HTTP_ACCEPT") are also canonical in their description of request header
|
|
|
|
|
fields. The number and meaning of these fields may change independently
|
|
|
|
|
of this specification. (See also <A HREF="#6.1.5">section 6.1.5</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.1">
|
|
|
|
|
6.1.1. AUTH_TYPE
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
This variable is specific to requests made
|
2007-02-11 14:52:07 +00:00
|
|
|
<EM>via</EM> the
|
|
|
|
|
"<CODE>http</CODE>"
|
|
|
|
|
scheme.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
If the Script-URI
|
|
|
|
|
required access authentication for external
|
2007-03-20 11:30:28 +00:00
|
|
|
access, then the server
|
2007-02-11 14:52:07 +00:00
|
|
|
MUST set
|
|
|
|
|
the value of
|
2007-03-20 11:30:28 +00:00
|
|
|
this variable
|
2007-02-11 14:52:07 +00:00
|
|
|
from the '<SAMP>auth-scheme</SAMP>' token in
|
|
|
|
|
the request's "<SAMP>Authorization</SAMP>" header
|
|
|
|
|
field.
|
|
|
|
|
Otherwise
|
|
|
|
|
it is
|
|
|
|
|
set to NULL.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
AUTH_TYPE = "" | auth-scheme
|
|
|
|
|
auth-scheme = "Basic" | "Digest" | token
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
HTTP access authentication schemes are described in section 11 of the
|
|
|
|
|
HTTP/1.1 specification [<A HREF="#[8]">8</A>]. The auth-scheme is
|
2007-03-20 11:30:28 +00:00
|
|
|
not case-sensitive.
|
2007-02-11 14:52:07 +00:00
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers
|
|
|
|
|
MUST
|
|
|
|
|
provide this metavariable
|
|
|
|
|
to scripts if the request
|
|
|
|
|
header included an "<SAMP>Authorization</SAMP>" field
|
|
|
|
|
that was authenticated.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.2">
|
|
|
|
|
6.1.2. CONTENT_LENGTH
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
This
|
|
|
|
|
metavariable
|
|
|
|
|
is set to the
|
|
|
|
|
size of the message-body
|
|
|
|
|
entity attached to the request, if any, in decimal
|
|
|
|
|
number of octets. If no data are attached, then this
|
|
|
|
|
metavariable
|
|
|
|
|
is either NULL or not
|
|
|
|
|
defined. The syntax is
|
|
|
|
|
the same as for
|
|
|
|
|
the HTTP "<SAMP>Content-Length</SAMP>" header field (section 14.14, HTTP/1.1
|
|
|
|
|
specification [<A HREF="#[8]">8</A>]).
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
CONTENT_LENGTH = "" | 1*digit
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts if the request
|
|
|
|
|
was accompanied by a
|
|
|
|
|
message-body entity.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.3">
|
|
|
|
|
6.1.3. CONTENT_TYPE
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
If the request includes a
|
|
|
|
|
message-body,
|
|
|
|
|
CONTENT_TYPE is set
|
|
|
|
|
to
|
|
|
|
|
the Internet Media Type
|
|
|
|
|
[<A HREF="#[9]">9</A>] of the attached
|
|
|
|
|
entity if the type was provided <EM>via</EM>
|
|
|
|
|
a "<SAMP>Content-type</SAMP>" field in the
|
|
|
|
|
request header, or if the server can determine it in the absence
|
2007-03-20 11:30:28 +00:00
|
|
|
of a supplied "<SAMP>Content-type</SAMP>" field. The syntax is the
|
2007-02-11 14:52:07 +00:00
|
|
|
same as for the HTTP
|
|
|
|
|
"<SAMP>Content-Type</SAMP>" header field.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
CONTENT_TYPE = "" | media-type
|
|
|
|
|
media-type = type "/" subtype *( ";" parameter)
|
|
|
|
|
type = token
|
|
|
|
|
subtype = token
|
|
|
|
|
parameter = attribute "=" value
|
|
|
|
|
attribute = token
|
|
|
|
|
value = token | quoted-string
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The type, subtype,
|
|
|
|
|
and parameter attribute names are not
|
|
|
|
|
case-sensitive. Parameter values MAY be case sensitive.
|
|
|
|
|
Media types and their use in HTTP are described
|
|
|
|
|
in section 3.7 of the
|
|
|
|
|
HTTP/1.1 specification [<A HREF="#[8]">8</A>].
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Example:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
application/x-www-form-urlencoded
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
There is no default value for this variable. If and only if it is
|
|
|
|
|
unset, then the script MAY attempt to determine the media type from
|
|
|
|
|
the data received. If the type remains unknown, then
|
|
|
|
|
the script MAY choose to either assume a
|
|
|
|
|
content-type of
|
2007-03-20 11:30:28 +00:00
|
|
|
<SAMP>application/octet-stream</SAMP>
|
2007-02-11 14:52:07 +00:00
|
|
|
or reject the request with a 415 ("Unsupported Media Type")
|
|
|
|
|
error. See <A HREF="#7.2.1.3">section 7.2.1.3</A>
|
|
|
|
|
for more information about returning error status values.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts if
|
|
|
|
|
a "<SAMP>Content-Type</SAMP>" field was present
|
|
|
|
|
in the original request header. If the server receives a request
|
|
|
|
|
with an attached entity but no "<SAMP>Content-Type</SAMP>"
|
|
|
|
|
header field, it MAY attempt to
|
|
|
|
|
determine the correct datatype, or it MAY omit this
|
|
|
|
|
metavariable when
|
|
|
|
|
communicating the request information to the script.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.4">
|
|
|
|
|
6.1.4. GATEWAY_INTERFACE
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
This
|
|
|
|
|
metavariable
|
|
|
|
|
is set to
|
|
|
|
|
the dialect of CGI being used
|
|
|
|
|
by the server to communicate with the script.
|
|
|
|
|
Syntax:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
GATEWAY_INTERFACE = "CGI" "/" major "." minor
|
|
|
|
|
major = 1*digit
|
|
|
|
|
minor = 1*digit
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Note that the major and minor numbers are treated as separate
|
2007-03-20 11:30:28 +00:00
|
|
|
integers and hence each may be
|
2007-02-11 14:52:07 +00:00
|
|
|
more than a single
|
|
|
|
|
digit. Thus CGI/2.4 is a lower version than CGI/2.13 which in turn
|
|
|
|
|
is lower than CGI/12.3. Leading zeros in either
|
|
|
|
|
the major or the minor number MUST be ignored by scripts and
|
|
|
|
|
SHOULD NOT be generated by servers.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
This document defines the 1.1 version of the CGI interface
|
|
|
|
|
("CGI/1.1").
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.5">
|
|
|
|
|
6.1.5. Protocol-Specific Metavariables
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
These metavariables are specific to
|
2007-03-20 11:30:28 +00:00
|
|
|
the protocol
|
2007-02-11 14:52:07 +00:00
|
|
|
<EM>via</EM> which the request is made.
|
2007-03-20 11:30:28 +00:00
|
|
|
Interpretation of these variables depends on the value of
|
|
|
|
|
the
|
2007-02-11 14:52:07 +00:00
|
|
|
SERVER_PROTOCOL
|
|
|
|
|
metavariable
|
|
|
|
|
(see
|
|
|
|
|
<A HREF="#6.1.17">section 6.1.17</A>).
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Metavariables
|
|
|
|
|
with names beginning with "HTTP_" contain
|
|
|
|
|
values from the request header, if the
|
|
|
|
|
scheme used was HTTP.
|
|
|
|
|
Each
|
|
|
|
|
HTTP header field name is converted to upper case, has all occurrences of
|
|
|
|
|
"-" replaced with "_",
|
|
|
|
|
and has "HTTP_" prepended to form
|
|
|
|
|
the metavariable name.
|
|
|
|
|
Similar transformations are applied for other
|
|
|
|
|
protocols.
|
|
|
|
|
The header data MAY be presented as sent
|
|
|
|
|
by the client, or MAY be rewritten in ways which do not change its
|
|
|
|
|
semantics. If multiple header fields with the same field-name are received
|
|
|
|
|
then the server
|
|
|
|
|
MUST rewrite them as though they
|
|
|
|
|
had been received as a single header field having the same
|
|
|
|
|
semantics before being represented in a
|
|
|
|
|
metavariable.
|
|
|
|
|
Similarly, a header field that is received on more than one line
|
|
|
|
|
MUST be merged into a single line. The server MUST, if necessary,
|
|
|
|
|
change the representation of the data (for example, the character
|
|
|
|
|
set) to be appropriate for a CGI
|
|
|
|
|
metavariable.
|
|
|
|
|
<!-- ###NOTE: See if 2068 describes this thoroughly, and
|
|
|
|
|
point there if so. -->
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers are
|
|
|
|
|
not required to create
|
|
|
|
|
metavariables for all
|
|
|
|
|
the request
|
|
|
|
|
header fields that they
|
|
|
|
|
receive. In particular,
|
2007-03-20 11:30:28 +00:00
|
|
|
they MAY
|
2007-02-11 14:52:07 +00:00
|
|
|
decline to make available any
|
|
|
|
|
header fields carrying authentication information, such as
|
|
|
|
|
"<SAMP>Authorization</SAMP>", or
|
|
|
|
|
which are available to the script
|
|
|
|
|
<EM>via</EM> other metavariables,
|
|
|
|
|
such as "<SAMP>Content-Length</SAMP>" and "<SAMP>Content-Type</SAMP>".
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.6">
|
|
|
|
|
6.1.6. PATH_INFO
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The PATH_INFO
|
|
|
|
|
metavariable
|
|
|
|
|
specifies
|
|
|
|
|
a path to be interpreted by the CGI script. It identifies the
|
|
|
|
|
resource or sub-resource to be returned
|
|
|
|
|
by the CGI
|
|
|
|
|
script, and it is derived from the portion
|
|
|
|
|
of the URI path following the script name but preceding
|
|
|
|
|
any query data.
|
|
|
|
|
The syntax
|
|
|
|
|
and semantics are similar to a decoded HTTP URL
|
|
|
|
|
'path' token
|
|
|
|
|
(defined in
|
|
|
|
|
RFC 2396
|
|
|
|
|
[<A HREF="#[4]">4</A>]), with the exception
|
2007-03-20 11:30:28 +00:00
|
|
|
that a PATH_INFO of "/"
|
2007-02-11 14:52:07 +00:00
|
|
|
represents a single void path segment.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
PATH_INFO = "" | ( "/" path )
|
|
|
|
|
path = segment *( "/" segment )
|
|
|
|
|
segment = *pchar
|
|
|
|
|
pchar = <any CHAR except "/">
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The PATH_INFO string is the trailing part of the <path> component of
|
|
|
|
|
the Script-URI
|
|
|
|
|
(see <A HREF="#3.2">section 3.2</A>)
|
2007-03-20 11:30:28 +00:00
|
|
|
that follows the SCRIPT_NAME
|
2007-02-11 14:52:07 +00:00
|
|
|
portion of the path.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY impose their own restrictions and
|
|
|
|
|
limitations on what values they will accept for PATH_INFO, and MAY
|
|
|
|
|
reject or edit any values they
|
|
|
|
|
consider objectionable before passing
|
|
|
|
|
them to the script.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST make this URI component available
|
|
|
|
|
to CGI scripts. The PATH_INFO
|
|
|
|
|
value is case-sensitive, and the
|
|
|
|
|
server MUST preserve the case of the PATH_INFO element of the URI
|
|
|
|
|
when making it available to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.7">
|
|
|
|
|
6.1.7. PATH_TRANSLATED
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
PATH_TRANSLATED is derived by taking any path-info component of the
|
|
|
|
|
request URI (see
|
|
|
|
|
<A HREF="#6.1.6">section 6.1.6</A>), decoding it
|
|
|
|
|
(see <A HREF="#3.1">section 3.1</A>), parsing it as a URI in its own
|
|
|
|
|
right, and performing any virtual-to-physical
|
|
|
|
|
translation appropriate to map it onto the
|
|
|
|
|
server's document repository structure.
|
|
|
|
|
If the request URI includes no path-info
|
|
|
|
|
component, the PATH_TRANSLATED metavariable SHOULD NOT be defined.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
PATH_TRANSLATED = *CHAR
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
For a request such as the following:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
http://somehost.com/cgi-bin/somescript/this%2eis%2epath%2einfo
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
the PATH_INFO component would be decoded, and the result
|
|
|
|
|
parsed as though it were a request for the following:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
http://somehost.com/this.is.the.path.info
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
This would then be translated to a
|
|
|
|
|
location in the server's document repository,
|
|
|
|
|
perhaps a filesystem path something
|
|
|
|
|
like this:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
/usr/local/www/htdocs/this.is.the.path.info
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The result of the translation is the value of PATH_TRANSLATED.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
The value of PATH_TRANSLATED may or may not map to a valid
|
|
|
|
|
repository
|
|
|
|
|
location.
|
|
|
|
|
Servers MUST preserve the case of the path-info
|
|
|
|
|
segment if and only if the underlying
|
|
|
|
|
repository
|
|
|
|
|
supports case-sensitive
|
|
|
|
|
names. If the
|
|
|
|
|
repository
|
|
|
|
|
is only case-aware, case-preserving, or case-blind
|
|
|
|
|
with regard to
|
|
|
|
|
document names,
|
|
|
|
|
servers are not required to preserve the
|
|
|
|
|
case of the original segment through the translation.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
The
|
2007-02-11 14:52:07 +00:00
|
|
|
translation
|
|
|
|
|
algorithm the server uses to derive PATH_TRANSLATED is
|
|
|
|
|
implementation defined; CGI scripts which use this variable may
|
|
|
|
|
suffer limited portability.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD provide this metavariable
|
|
|
|
|
to scripts if and only if the request URI includes a
|
|
|
|
|
path-info component.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.8">
|
|
|
|
|
6.1.8. QUERY_STRING
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
A URL-encoded
|
2007-02-11 14:52:07 +00:00
|
|
|
string; the <query> part of the
|
|
|
|
|
Script-URI.
|
|
|
|
|
(See
|
|
|
|
|
<A HREF="#3.2">section 3.2</A>.)
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
QUERY_STRING = query-string
|
|
|
|
|
query-string = *uric
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The URL syntax for a query
|
|
|
|
|
string is described in
|
|
|
|
|
section 3 of
|
|
|
|
|
RFC 2396
|
|
|
|
|
[<A HREF="#[4]">4</A>].
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST supply this value to scripts.
|
|
|
|
|
The QUERY_STRING value is case-sensitive.
|
|
|
|
|
If the Script-URI does not include a query component,
|
|
|
|
|
the QUERY_STRING metavariable MUST be defined as an empty string ("").
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.9">
|
|
|
|
|
6.1.9. REMOTE_ADDR
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The IP address of the client
|
|
|
|
|
sending the request to the server. This
|
|
|
|
|
is not necessarily that of the user
|
|
|
|
|
agent
|
|
|
|
|
(such as if the request came through a proxy).
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
REMOTE_ADDR = hostnumber
|
|
|
|
|
hostnumber = ipv4-address | ipv6-address
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The definitions of <SAMP>ipv4-address</SAMP> and <SAMP>ipv6-address</SAMP>
|
|
|
|
|
are provided in Appendix B of RFC 2373 [<A HREF="#[13]">13</A>].
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST supply this value to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.10">
|
|
|
|
|
6.1.10. REMOTE_HOST
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The fully qualified domain name of the
|
|
|
|
|
client sending the request to
|
|
|
|
|
the server, if available, otherwise NULL.
|
|
|
|
|
(See <A HREF="#6.1.9">section 6.1.9</A>.)
|
|
|
|
|
Fully qualified domain names take the form as described in
|
|
|
|
|
section 3.5 of RFC 1034 [<A HREF="#[10]">10</A>] and section 2.1 of
|
|
|
|
|
RFC 1123 [<A HREF="#[5]">5</A>]. Domain names are not case sensitive.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD provide this information to
|
|
|
|
|
scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.11">
|
|
|
|
|
6.1.11. REMOTE_IDENT
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The identity information reported about the connection by a
|
|
|
|
|
RFC 1413 [<A HREF="#[11]">11</A>] request to the remote agent, if
|
|
|
|
|
available. Servers
|
|
|
|
|
MAY choose not
|
|
|
|
|
to support this feature, or not to request the data
|
|
|
|
|
for efficiency reasons.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
REMOTE_IDENT = *CHAR
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The data returned
|
|
|
|
|
may be used for authentication purposes, but the level
|
|
|
|
|
of trust reposed in them should be minimal.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY supply this information to scripts if the
|
|
|
|
|
RFC1413 [<A HREF="#[11]">11</A>] lookup is performed.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.12">
|
|
|
|
|
6.1.12. REMOTE_USER
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
If the request required authentication using the "Basic"
|
|
|
|
|
mechanism (<EM>i.e.</EM>, the AUTH_TYPE
|
|
|
|
|
metavariable is set
|
|
|
|
|
to "Basic"), then the value of the REMOTE_USER
|
|
|
|
|
metavariable is set to the
|
|
|
|
|
user-ID supplied. In all other cases
|
|
|
|
|
the value of this metavariable
|
|
|
|
|
is undefined.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
REMOTE_USER = *OCTET
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
This variable is specific to requests made <EM>via</EM> the
|
|
|
|
|
HTTP protocol.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.13">
|
|
|
|
|
6.1.13. REQUEST_METHOD
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The REQUEST_METHOD
|
|
|
|
|
metavariable
|
|
|
|
|
is set to the
|
|
|
|
|
method with which the request was made, as described in section
|
|
|
|
|
5.1.1 of the HTTP/1.0 specification [<A HREF="#[3]">3</A>] and
|
2007-03-20 11:30:28 +00:00
|
|
|
section 5.1.1 of the
|
2007-02-11 14:52:07 +00:00
|
|
|
HTTP/1.1 specification [<A HREF="#[8]">8</A>].
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
REQUEST_METHOD = http-method
|
|
|
|
|
http-method = "GET" | "HEAD" | "POST" | "PUT" | "DELETE"
|
|
|
|
|
| "OPTIONS" | "TRACE" | extension-method
|
|
|
|
|
extension-method = token
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
The method is case sensitive.
|
2007-02-11 14:52:07 +00:00
|
|
|
CGI/1.1 servers MAY choose to process some methods
|
|
|
|
|
directly rather than passing them to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
This variable is specific to requests made with HTTP.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.14">
|
|
|
|
|
6.1.14. SCRIPT_NAME
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The SCRIPT_NAME
|
|
|
|
|
metavariable
|
|
|
|
|
is
|
|
|
|
|
set to a URL path that could identify the CGI script (rather than the
|
|
|
|
|
script's
|
|
|
|
|
output). The syntax and semantics are identical to a
|
|
|
|
|
decoded HTTP URL 'path' token
|
|
|
|
|
(see RFC 2396
|
|
|
|
|
[<A HREF="#[4]">4</A>]).
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
SCRIPT_NAME = "" | ( "/" [ path ] )
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The SCRIPT_NAME string is some leading part of the <path> component
|
|
|
|
|
of the Script-URI derived in some
|
|
|
|
|
implementation defined manner.
|
|
|
|
|
No PATH_INFO or QUERY_STRING segments
|
|
|
|
|
(see sections <A HREF="#6.1.6">6.1.6</A> and
|
|
|
|
|
<A HREF="#6.1.8">6.1.8</A>) are included
|
|
|
|
|
in the SCRIPT_NAME value.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.15">
|
|
|
|
|
6.1.15. SERVER_NAME
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The SERVER_NAME
|
|
|
|
|
metavariable
|
|
|
|
|
is set to the
|
|
|
|
|
name of the
|
2007-03-20 11:30:28 +00:00
|
|
|
server, as
|
2007-02-11 14:52:07 +00:00
|
|
|
derived from the <host> part of the
|
|
|
|
|
Script-URI
|
|
|
|
|
(see <A HREF="#3.2">section 3.2</A>).
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
SERVER_NAME = hostname | hostnumber
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.16">
|
|
|
|
|
6.1.16. SERVER_PORT
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The SERVER_PORT
|
|
|
|
|
metavariable
|
|
|
|
|
is set to the
|
|
|
|
|
port on which the
|
|
|
|
|
request was received, as used in the <port>
|
|
|
|
|
part of the Script-URI.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
SERVER_PORT = 1*digit
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
If the <port> portion of the script-URI is blank, the actual
|
|
|
|
|
port number upon which the request was received MUST be supplied.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.17">
|
|
|
|
|
6.1.17. SERVER_PROTOCOL
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The SERVER_PROTOCOL
|
|
|
|
|
metavariable
|
|
|
|
|
is set to
|
|
|
|
|
the
|
|
|
|
|
name and revision of the information protocol with which
|
|
|
|
|
the
|
|
|
|
|
request
|
|
|
|
|
arrived. This is not necessarily the same as the protocol version used by
|
|
|
|
|
the server in its response to the client.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
SERVER_PROTOCOL = HTTP-Version | extension-version
|
|
|
|
|
| extension-token
|
|
|
|
|
HTTP-Version = "HTTP" "/" 1*digit "." 1*digit
|
|
|
|
|
extension-version = protocol "/" 1*digit "." 1*digit
|
|
|
|
|
protocol = 1*( alpha | digit | "+" | "-" | "." )
|
|
|
|
|
extension-token = token
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
'protocol' is a version of the <scheme> part of the
|
|
|
|
|
Script-URI, but is
|
|
|
|
|
not identical to it. For example, the scheme of a request may be
|
|
|
|
|
"<SAMP>https</SAMP>" while the protocol remains "<SAMP>http</SAMP>".
|
|
|
|
|
The protocol is not case sensitive, but
|
|
|
|
|
by convention, 'protocol' is in
|
|
|
|
|
upper case.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
A well-known extension token value is "INCLUDED",
|
|
|
|
|
which signals that the current document is being included as part of
|
|
|
|
|
a composite document, rather than being the direct target of the
|
|
|
|
|
client request.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="6.1.18">
|
|
|
|
|
6.1.18. SERVER_SOFTWARE
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The SERVER_SOFTWARE
|
|
|
|
|
metavariable
|
|
|
|
|
is set to the
|
|
|
|
|
name and version of the information server software answering the
|
|
|
|
|
request (and running the gateway).
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
SERVER_SOFTWARE = 1*product
|
|
|
|
|
product = token [ "/" product-version ]
|
|
|
|
|
product-version = token
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide this metavariable
|
|
|
|
|
to scripts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="6.2">
|
|
|
|
|
6.2. Request Message-Bodies
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
As there may be a data entity attached to the request, there MUST be
|
|
|
|
|
a system defined method for the script to read
|
|
|
|
|
these data. Unless
|
|
|
|
|
defined otherwise, this will be <EM>via</EM> the 'standard input' file
|
|
|
|
|
descriptor.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
If the CONTENT_LENGTH value (see <A HREF="#6.1.2">section 6.1.2</A>)
|
|
|
|
|
is non-NULL, the server MUST supply at least that many bytes to
|
|
|
|
|
scripts on the standard input stream.
|
|
|
|
|
Scripts are
|
|
|
|
|
not obliged to read the data.
|
|
|
|
|
Servers MAY signal an EOF condition after CONTENT_LENGTH bytes have been
|
|
|
|
|
read, but are
|
|
|
|
|
not obligated to do so. Therefore, scripts
|
|
|
|
|
MUST NOT
|
|
|
|
|
attempt to read more than CONTENT_LENGTH bytes, even if more data
|
|
|
|
|
are available.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
For non-parsed header (NPH) scripts (see
|
|
|
|
|
<A HREF="#7.1">section 7.1</A>
|
2007-03-20 11:30:28 +00:00
|
|
|
below),
|
2007-02-11 14:52:07 +00:00
|
|
|
servers SHOULD
|
|
|
|
|
attempt to ensure that the data
|
|
|
|
|
supplied to the script are precisely
|
|
|
|
|
as supplied by the client and unaltered by
|
|
|
|
|
the server.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
<A HREF="#8.1.2">Section 8.1.2</A> describes the requirements of
|
|
|
|
|
servers with regard to requests that include
|
|
|
|
|
message-bodies.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="7.0">
|
|
|
|
|
7. Data Output from the CGI Script
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
There MUST be a system defined method for the script to send data
|
|
|
|
|
back to the server or client; a script MUST always return some data.
|
|
|
|
|
Unless defined otherwise, this will be <EM>via</EM> the 'standard
|
|
|
|
|
output' file descriptor.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
There are two forms of output that scripts can supply to servers: non-parsed
|
|
|
|
|
header (NPH) output, and parsed header output.
|
|
|
|
|
Servers MUST support parsed header
|
|
|
|
|
output and MAY support NPH output. The method of
|
|
|
|
|
distinguishing between the two
|
|
|
|
|
types of output (or scripts) is implementation defined.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY implement a timeout period within which data must be
|
|
|
|
|
received from scripts. If a server implementation defines such
|
|
|
|
|
a timeout and receives no data from a script within the timeout
|
|
|
|
|
period, the server MAY terminate the script process and SHOULD
|
|
|
|
|
abort the client request with
|
|
|
|
|
either a
|
|
|
|
|
'504 Gateway Timed Out' or a
|
|
|
|
|
'500 Internal Server Error' response.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="7.1">
|
|
|
|
|
7.1. Non-Parsed Header Output
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts using the NPH output form
|
|
|
|
|
MUST return a complete HTTP response message, as described
|
|
|
|
|
in Section 6 of the HTTP specifications
|
|
|
|
|
[<A HREF="#[3]">3</A>,<A HREF="#[8]">8</A>].
|
|
|
|
|
NPH scripts
|
|
|
|
|
MUST use the SERVER_PROTOCOL variable to determine the appropriate format
|
|
|
|
|
for a response.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers
|
|
|
|
|
SHOULD attempt to ensure that the script output is sent
|
|
|
|
|
directly to the client, with minimal
|
|
|
|
|
internal and no transport-visible
|
|
|
|
|
buffering.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="7.2">
|
|
|
|
|
7.2. Parsed Header Output
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts using the parsed header output form MUST supply
|
|
|
|
|
a CGI response message to the server
|
|
|
|
|
as follows:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
CGI-Response = *optional-field CGI-Field *optional-field NL [ Message-Body ]
|
|
|
|
|
optional-field = ( CGI-Field | HTTP-Field )
|
|
|
|
|
CGI-Field = Content-type
|
|
|
|
|
| Location
|
|
|
|
|
| Status
|
|
|
|
|
| extension-header
|
|
|
|
|
</PRE>
|
|
|
|
|
<P><!-- ##### If HTTP defines x-headers, remove ours except x-cgi- -->
|
|
|
|
|
The response comprises a header and a body, separated by a blank line.
|
|
|
|
|
The body may be NULL.
|
|
|
|
|
The header fields are either CGI header fields to be interpreted by
|
|
|
|
|
the server, or HTTP header fields
|
|
|
|
|
to be included in the response returned
|
|
|
|
|
to the client
|
|
|
|
|
if the request method is HTTP. At least one
|
|
|
|
|
CGI-Field MUST be
|
|
|
|
|
supplied, but no CGI field name may be used more than once
|
|
|
|
|
in a response.
|
|
|
|
|
If a body is supplied, then a "<SAMP>Content-type</SAMP>"
|
|
|
|
|
header field MUST be
|
|
|
|
|
supplied by the script,
|
|
|
|
|
otherwise the script MUST send a "<SAMP>Location</SAMP>"
|
|
|
|
|
or "<SAMP>Status</SAMP>" header field. If a
|
|
|
|
|
<SAMP>Location</SAMP> CGI-Field
|
|
|
|
|
is returned, then the script MUST NOT supply
|
|
|
|
|
any HTTP-Fields.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Each header field in a CGI-Response MUST be specified on a single line;
|
|
|
|
|
CGI/1.1 does not support continuation lines.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.1">
|
|
|
|
|
7.2.1. CGI header fields
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The CGI header fields have the generic syntax:
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
generic-field = field-name ":" [ field-value ] NL
|
|
|
|
|
field-name = token
|
|
|
|
|
field-value = *( field-content | LWSP )
|
|
|
|
|
field-content = *( token | tspecial | quoted-string )
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The field-name is not case sensitive; a NULL field value is
|
|
|
|
|
equivalent to the header field not being sent.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.1.1">
|
|
|
|
|
7.2.1.1. Content-Type
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The Internet Media Type [<A HREF="#[9]">9</A>] of the entity
|
|
|
|
|
body, which is to be sent unmodified to the client.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
Content-Type = "Content-Type" ":" media-type NL
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
This is actually an HTTP-Field
|
|
|
|
|
rather than a CGI-Field, but
|
|
|
|
|
it is listed here because of its importance in the CGI dialogue as
|
|
|
|
|
a member of the "one of these is required" set of header
|
|
|
|
|
fields.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.1.2">
|
|
|
|
|
7.2.1.2. Location
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
This is used to specify to the server that the script is returning a
|
|
|
|
|
reference to a document rather than an actual document.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
Location = "Location" ":"
|
|
|
|
|
( fragment-URI | rel-URL-abs-path ) NL
|
|
|
|
|
fragment-URI = URI [ # fragmentid ]
|
|
|
|
|
URI = scheme ":" *qchar
|
|
|
|
|
fragmentid = *qchar
|
|
|
|
|
rel-URL-abs-path = "/" [ hpath ] [ "?" query-string ]
|
|
|
|
|
hpath = fpsegment *( "/" psegment )
|
|
|
|
|
fpsegment = 1*hchar
|
|
|
|
|
psegment = *hchar
|
|
|
|
|
hchar = alpha | digit | safe | extra
|
|
|
|
|
| ":" | "@" | "& | "="
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The Location
|
|
|
|
|
value is either an absolute URI with optional fragment,
|
|
|
|
|
as defined in RFC 1630 [<A HREF="#[1]">1</A>], or an absolute path
|
|
|
|
|
within the server's URI space (<EM>i.e.</EM>,
|
2007-03-20 11:30:28 +00:00
|
|
|
omitting the scheme and network-related fields) and optional
|
2007-02-11 14:52:07 +00:00
|
|
|
query-string. If an absolute URI is returned by the script,
|
|
|
|
|
then the
|
|
|
|
|
server MUST generate a
|
|
|
|
|
'302 redirect' HTTP response
|
|
|
|
|
message unless the script has supplied an
|
|
|
|
|
explicit Status response header field.
|
|
|
|
|
Scripts returning an absolute URI MAY choose to
|
|
|
|
|
provide a message-body. Servers MUST make any appropriate modifications
|
|
|
|
|
to the script's output to ensure the response to the user-agent complies
|
|
|
|
|
with the response protocol version.
|
|
|
|
|
If the Location value is a path, then the server
|
|
|
|
|
MUST generate
|
|
|
|
|
the response that it would have produced in response to a request
|
|
|
|
|
containing the URL
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
scheme "://" SERVER_NAME ":" SERVER_PORT rel-URL-abs-path
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Note: If the request was accompanied by a
|
|
|
|
|
message-body
|
|
|
|
|
(such as for a POST request), and the script
|
|
|
|
|
redirects the request with a Location field, the
|
|
|
|
|
message-body
|
|
|
|
|
may not be
|
|
|
|
|
available to the resource that is the target of the redirect.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.1.3">
|
|
|
|
|
7.2.1.3. Status
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The "<SAMP>Status</SAMP>" header field is used to indicate to the server what
|
|
|
|
|
status code the server MUST use in the response message.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
Status = "Status" ":" digit digit digit SP reason-phrase NL
|
|
|
|
|
reason-phrase = *<CHAR, excluding CTLs, NL>
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
The valid status codes are listed in section 6.1.1 of the HTTP/1.0
|
|
|
|
|
specifications [<A HREF="#[3]">3</A>]. If the SERVER_PROTOCOL is
|
|
|
|
|
"HTTP/1.1", then the status codes defined in the HTTP/1.1
|
2007-03-20 11:30:28 +00:00
|
|
|
specification [<A HREF="#[8]">8</A>] may
|
2007-02-11 14:52:07 +00:00
|
|
|
be used. If the script does not return a "<SAMP>Status</SAMP>" header
|
|
|
|
|
field, then "200 OK" SHOULD be assumed by the server.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
If a script is being used to handle a particular error or condition
|
|
|
|
|
encountered by the server, such as a '404 Not Found' error, the script
|
|
|
|
|
SHOULD use the "<SAMP>Status</SAMP>" CGI header field to propagate the error
|
|
|
|
|
condition back to the client. <EM>E.g.</EM>, in the example mentioned it
|
|
|
|
|
SHOULD include a "Status: 404 Not Found" in the
|
|
|
|
|
header data returned to the server.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.1.4">
|
|
|
|
|
7.2.1.4. Extension header fields
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts MAY include in their CGI response header additional fields
|
|
|
|
|
not defined in this or the HTTP specification.
|
|
|
|
|
These are called "extension" fields,
|
|
|
|
|
and have the syntax of a <SAMP>generic-field</SAMP> as defined in
|
|
|
|
|
<A HREF="#7.2.1">section 7.2.1</A>. The name of an extension field
|
|
|
|
|
MUST NOT conflict with a field name defined in this or any other
|
|
|
|
|
specification; extension field names SHOULD begin with "X-CGI-"
|
|
|
|
|
to ensure uniqueness.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H4>
|
|
|
|
|
<A NAME="7.2.2">
|
|
|
|
|
7.2.2. HTTP header fields
|
|
|
|
|
</A>
|
|
|
|
|
</H4>
|
|
|
|
|
<P>
|
|
|
|
|
The script MAY return any other header fields defined by the
|
|
|
|
|
specification
|
|
|
|
|
for the SERVER_PROTOCOL (HTTP/1.0 [<A HREF="#[3]">3</A>] or HTTP/1.1
|
|
|
|
|
[<A HREF="#[8]">8</A>]).
|
|
|
|
|
Servers MUST resolve conflicts beteen CGI header
|
|
|
|
|
and HTTP header formats or names (see <A HREF="#8.0">section 8</A>).
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="8.0">
|
|
|
|
|
8. Server Implementation
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
This section defines the requirements that must be met by HTTP
|
|
|
|
|
servers in order to provide a coherent and correct CGI/1.1
|
|
|
|
|
environment in which scripts may function. It is intended
|
|
|
|
|
primarily for server implementors, but it is useful for
|
|
|
|
|
script authors to be familiar with the information as well.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.1">
|
|
|
|
|
8.1. Requirements for Servers
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
In order to be considered CGI/1.1-compliant, a server must meet
|
|
|
|
|
certain basic criteria and provide certain minimal functionality.
|
|
|
|
|
The details of these requirements are described in the following sections.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.1.1">
|
|
|
|
|
8.1.1. Script-URI
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST support the standard mechanism (described below) which
|
2007-03-20 11:30:28 +00:00
|
|
|
allows
|
2007-02-11 14:52:07 +00:00
|
|
|
script authors to determine
|
|
|
|
|
what URL to use in documents
|
|
|
|
|
which reference the script;
|
|
|
|
|
specifically, what URL to use in order to
|
|
|
|
|
achieve particular settings of the
|
|
|
|
|
metavariables. This
|
|
|
|
|
mechanism is as follows:
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
The server
|
2007-02-11 14:52:07 +00:00
|
|
|
MUST translate the header data from the CGI header field syntax to
|
|
|
|
|
the HTTP
|
|
|
|
|
header field syntax if these differ. For example, the character
|
2007-03-20 11:30:28 +00:00
|
|
|
sequence for
|
2007-02-11 14:52:07 +00:00
|
|
|
newline (such as Unix's ASCII NL) used by CGI scripts may not be the
|
|
|
|
|
same as that used by HTTP (ASCII CR followed by LF). The server MUST
|
|
|
|
|
also resolve any conflicts between header fields returned by the script
|
|
|
|
|
and header fields that it would otherwise send itself.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.1.2">
|
|
|
|
|
8.1.2. Request Message-body Handling
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
These are the requirements for server handling of message-bodies directed
|
|
|
|
|
to CGI/1.1 resources:
|
|
|
|
|
</P>
|
|
|
|
|
<OL>
|
|
|
|
|
<LI>The message-body the server provides to the CGI script MUST
|
|
|
|
|
have any transfer encodings removed.
|
|
|
|
|
</LI>
|
|
|
|
|
<LI>The server MUST derive and provide a value for the CONTENT_LENGTH
|
|
|
|
|
metavariable that reflects the length of the message-body after any
|
|
|
|
|
transfer decoding.
|
|
|
|
|
</LI>
|
|
|
|
|
<LI>The server MUST leave intact any content-encodings of the message-body.
|
|
|
|
|
</LI>
|
|
|
|
|
</OL>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.1.3">
|
|
|
|
|
8.1.3. Required Metavariables
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide scripts with certain information and
|
|
|
|
|
metavariables
|
|
|
|
|
as described in <A HREF="#8.3">section 8.3</A>.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.1.4">
|
|
|
|
|
8.1.4. Response Compliance
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST ensure that responses sent to the user-agent meet all
|
|
|
|
|
requirements of the protocol level in effect. This may involve
|
|
|
|
|
modifying, deleting, or augmenting any header
|
|
|
|
|
fields and/or message-body supplied by the script.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.2">
|
|
|
|
|
8.2. Recommendations for Servers
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD provide the "<SAMP>query</SAMP>" component of the script-URI
|
|
|
|
|
as command-line arguments to scripts if it does not
|
|
|
|
|
contain any unencoded '=' characters and the command-line arguments can
|
|
|
|
|
be generated in an unambiguous manner.
|
|
|
|
|
(See <A HREF="#5.0">section 5</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD set the AUTH_TYPE
|
|
|
|
|
metavariable to the value of the
|
|
|
|
|
'<SAMP>auth-scheme</SAMP>' token of the "<SAMP>Authorization</SAMP>"
|
|
|
|
|
field if it was supplied as part of the request header.
|
|
|
|
|
(See <A HREF="#6.1.1">section 6.1.1</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Where applicable, servers SHOULD set the current working directory
|
|
|
|
|
to the directory in which the script is located before invoking
|
|
|
|
|
it.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY reject with error '404 Not Found'
|
|
|
|
|
any requests that would result in
|
|
|
|
|
an encoded "/" being decoded into PATH_INFO or SCRIPT_NAME, as this
|
|
|
|
|
might represent a loss of information to the script.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Although the server and the CGI script need not be consistent in
|
|
|
|
|
their handling of URL paths (client URLs and the PATH_INFO data,
|
|
|
|
|
respectively), server authors may wish to impose consistency.
|
|
|
|
|
So the server implementation SHOULD define its behaviour for the
|
|
|
|
|
following cases:
|
|
|
|
|
</P>
|
|
|
|
|
<OL>
|
|
|
|
|
<LI>define any restrictions on allowed characters, in particular
|
|
|
|
|
whether ASCII NUL is permitted;
|
|
|
|
|
</LI>
|
|
|
|
|
<LI>define any restrictions on allowed path segments, in particular
|
|
|
|
|
whether non-terminal NULL segments are permitted;
|
|
|
|
|
</LI>
|
|
|
|
|
<LI>define the behaviour for <SAMP>"."</SAMP> or <SAMP>".."</SAMP> path
|
|
|
|
|
segments; <EM>i.e.</EM>, whether they are prohibited, treated as
|
2007-03-20 11:30:28 +00:00
|
|
|
ordinary path
|
2007-02-11 14:52:07 +00:00
|
|
|
segments or interpreted in accordance with the relative URL
|
|
|
|
|
specification [<A HREF="#[7]">7</A>];
|
|
|
|
|
</LI>
|
|
|
|
|
<LI>define any limits of the implementation, including limits on path or
|
|
|
|
|
search string lengths, and limits on the volume of header data the server
|
|
|
|
|
will parse.
|
|
|
|
|
</LI><!-- ##### Move the field resolution/translation para below here -->
|
|
|
|
|
</OL>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY generate the
|
|
|
|
|
Script-URI in
|
|
|
|
|
any way from the client URI,
|
|
|
|
|
or from any other data (but the behaviour SHOULD be documented).
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
For non-parsed header (NPH) scripts (see
|
|
|
|
|
<A HREF="#7.1">section 7.1</A>), servers SHOULD
|
|
|
|
|
attempt to ensure that the script input comes directly from the
|
|
|
|
|
client, with minimal buffering. For all scripts the data will be
|
|
|
|
|
as supplied by the client.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="8.3">
|
|
|
|
|
8.3. Summary of
|
|
|
|
|
MetaVariables
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MUST provide the following
|
|
|
|
|
metavariables to
|
|
|
|
|
scripts. See the individual descriptions for exceptions and semantics.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
CONTENT_LENGTH (section <A HREF="#6.1.2">6.1.2</A>)
|
|
|
|
|
CONTENT_TYPE (section <A HREF="#6.1.3">6.1.3</A>)
|
|
|
|
|
GATEWAY_INTERFACE (section <A HREF="#6.1.4">6.1.4</A>)
|
|
|
|
|
PATH_INFO (section <A HREF="#6.1.6">6.1.6</A>)
|
|
|
|
|
QUERY_STRING (section <A HREF="#6.1.8">6.1.8</A>)
|
|
|
|
|
REMOTE_ADDR (section <A HREF="#6.1.9">6.1.9</A>)
|
|
|
|
|
REQUEST_METHOD (section <A HREF="#6.1.13">6.1.13</A>)
|
|
|
|
|
SCRIPT_NAME (section <A HREF="#6.1.14">6.1.14</A>)
|
|
|
|
|
SERVER_NAME (section <A HREF="#6.1.15">6.1.15</A>)
|
|
|
|
|
SERVER_PORT (section <A HREF="#6.1.16">6.1.16</A>)
|
|
|
|
|
SERVER_PROTOCOL (section <A HREF="#6.1.17">6.1.17</A>)
|
|
|
|
|
SERVER_SOFTWARE (section <A HREF="#6.1.18">6.1.18</A>)
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Servers SHOULD define the following
|
|
|
|
|
metavariables for scripts.
|
|
|
|
|
See the individual descriptions for exceptions and semantics.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
AUTH_TYPE (section <A HREF="#6.1.1">6.1.1</A>)
|
|
|
|
|
REMOTE_HOST (section <A HREF="#6.1.10">6.1.10</A>)
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
In addition, servers SHOULD provide
|
|
|
|
|
metavariables for all fields present
|
|
|
|
|
in the HTTP request header, with the exception of those involved with
|
|
|
|
|
access control. Servers MAY at their discretion provide
|
|
|
|
|
metavariables
|
|
|
|
|
for access control fields.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY define the following
|
|
|
|
|
metavariables. See the individual
|
|
|
|
|
descriptions for exceptions and semantics.
|
|
|
|
|
</P><!--#if expr="! $GUI" -->
|
|
|
|
|
<P></P><!--#endif -->
|
|
|
|
|
<PRE>
|
|
|
|
|
PATH_TRANSLATED (section <A HREF="#6.1.7">6.1.7</A>)
|
|
|
|
|
REMOTE_IDENT (section <A HREF="#6.1.11">6.1.11</A>)
|
|
|
|
|
REMOTE_USER (section <A HREF="#6.1.12">6.1.12</A>)
|
|
|
|
|
</PRE>
|
|
|
|
|
<P>
|
|
|
|
|
Servers MAY
|
|
|
|
|
at their discretion define additional implementation-specific
|
|
|
|
|
extension metavariables
|
|
|
|
|
provided their names do not
|
|
|
|
|
conflict with defined header field names. Implementation-specific
|
|
|
|
|
metavariable names SHOULD
|
|
|
|
|
be prefixed with "X_" (<EM>e.g.</EM>,
|
|
|
|
|
"X_DBA") to avoid the potential for such conflicts.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="9.0">
|
2007-03-20 11:30:28 +00:00
|
|
|
9.
|
2007-02-11 14:52:07 +00:00
|
|
|
Script Implementation
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
This section defines the requirements and recommendations for scripts
|
|
|
|
|
that are intended to function in a CGI/1.1 environment. It is intended
|
|
|
|
|
primarily as a reference for script authors, but server implementors
|
|
|
|
|
should be familiar with these issues as well.
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="9.1">
|
|
|
|
|
9.1. Requirements for Scripts
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts using the parsed-header method to communicate with servers
|
|
|
|
|
MUST supply a response header to the server.
|
|
|
|
|
(See <A HREF="#7.0">section 7</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts using the NPH method to communicate with servers MUST
|
|
|
|
|
provide complete HTTP responses, and MUST use the value of the
|
|
|
|
|
SERVER_PROTOCOL metavariable
|
|
|
|
|
to determine the appropriate format.
|
|
|
|
|
(See <A HREF="#7.1">section 7.1</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts MUST check the value of the REQUEST_METHOD
|
|
|
|
|
metavariable in order
|
|
|
|
|
to provide an appropriate response.
|
|
|
|
|
(See <A HREF="#6.1.13">section 6.1.13</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts MUST be prepared to handled URL-encoded values in
|
|
|
|
|
metavariables.
|
|
|
|
|
In addition, they MUST recognise both "+" and "%20" in URL-encoded
|
|
|
|
|
quantities as representing the space character.
|
|
|
|
|
(See <A HREF="#3.1">section 3.1</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts MUST ignore leading zeros in the major and minor version numbers
|
|
|
|
|
in the GATEWAY_INTERFACE
|
|
|
|
|
metavariable value. (See
|
|
|
|
|
<A HREF="#6.1.4">section 6.1.4</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
When processing requests that include a
|
|
|
|
|
message-body, scripts
|
|
|
|
|
MUST NOT read more than CONTENT_LENGTH bytes from the input stream.
|
|
|
|
|
(See sections <A HREF="#6.1.2">6.1.2</A> and <A HREF="#6.2">6.2</A>.)
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="9.2">
|
|
|
|
|
9.2. Recommendations for Scripts
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Servers may interrupt or terminate script execution at any time
|
|
|
|
|
and without warning, so scripts SHOULD be prepared to deal with
|
|
|
|
|
abnormal termination.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts MUST
|
|
|
|
|
reject with
|
|
|
|
|
error '405 Method Not
|
|
|
|
|
Allowed' requests
|
|
|
|
|
made using methods that they do not support. If the script does
|
|
|
|
|
not intend
|
|
|
|
|
processing the PATH_INFO data, then it SHOULD reject the request with
|
|
|
|
|
'404 Not
|
|
|
|
|
Found' if PATH_INFO is not NULL.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
If a script is processing the output of a form, it SHOULD
|
2007-02-11 14:52:07 +00:00
|
|
|
verify that the CONTENT_TYPE
|
|
|
|
|
is "<SAMP>application/x-www-form-urlencoded</SAMP>" [<A HREF="#[2]">2</A>]
|
|
|
|
|
or whatever other media type is expected.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Scripts parsing PATH_INFO,
|
|
|
|
|
PATH_TRANSLATED, or SCRIPT_NAME
|
|
|
|
|
SHOULD be careful
|
|
|
|
|
of void path segments ("<SAMP>//</SAMP>") and special path segments
|
|
|
|
|
(<SAMP>"."</SAMP> and
|
|
|
|
|
<SAMP>".."</SAMP>). They SHOULD either be removed from the path before
|
2007-03-20 11:30:28 +00:00
|
|
|
use in OS
|
2007-02-11 14:52:07 +00:00
|
|
|
system calls, or the request SHOULD be rejected with
|
|
|
|
|
'404 Not Found'.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
As it is impossible for
|
2007-02-11 14:52:07 +00:00
|
|
|
scripts to determine the client URI that
|
|
|
|
|
initiated a
|
|
|
|
|
request without knowledge of the specific server in
|
|
|
|
|
use, the script SHOULD NOT return "<SAMP>text/html</SAMP>"
|
|
|
|
|
documents containing
|
|
|
|
|
relative URL links without including a "<SAMP><BASE></SAMP>"
|
|
|
|
|
tag in the document.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
2007-03-20 11:30:28 +00:00
|
|
|
When returning header fields,
|
2007-02-11 14:52:07 +00:00
|
|
|
scripts SHOULD try to send the CGI
|
|
|
|
|
header fields (see section
|
|
|
|
|
<A HREF="#7.2">7.2</A>) as soon as possible, and
|
|
|
|
|
SHOULD send them
|
|
|
|
|
before any HTTP header fields. This may
|
|
|
|
|
help reduce the server's memory requirements.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="10.0">
|
|
|
|
|
10. System Specifications
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="10.1">
|
|
|
|
|
10.1. AmigaDOS
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The implementation of the CGI on an AmigaDOS operating system platform
|
|
|
|
|
SHOULD use environment variables as the mechanism of providing
|
|
|
|
|
request metadata to CGI scripts.
|
|
|
|
|
</P>
|
|
|
|
|
<DL>
|
|
|
|
|
<DT><STRONG>Environment variables</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
These are accessed by the DOS library routine <SAMP>GetVar</SAMP>. The
|
|
|
|
|
flags argument SHOULD be 0. Case is ignored, but upper case is
|
|
|
|
|
recommended for compatibility with case-sensitive systems.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><STRONG>The current working directory</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The current working directory for the script is set to the directory
|
|
|
|
|
containing the script.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><STRONG>Character set</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The US-ASCII character set is used for the definition of environment
|
|
|
|
|
variable names and header
|
|
|
|
|
field names; the newline (NL) sequence is LF;
|
|
|
|
|
servers SHOULD also accept CR LF as a newline.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="10.2">
|
|
|
|
|
10.2. Unix
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The implementation of the CGI on a UNIX operating system platform
|
|
|
|
|
SHOULD use environment variables as the mechanism of providing
|
|
|
|
|
request metadata to CGI scripts.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
For Unix compatible operating systems, the following are defined:
|
|
|
|
|
</P>
|
|
|
|
|
<DL>
|
|
|
|
|
<DT><STRONG>Environment variables</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
These are accessed by the C library routine <SAMP>getenv</SAMP>.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><STRONG>The command line</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
This is accessed using the
|
|
|
|
|
<SAMP>argc</SAMP> and <SAMP>argv</SAMP>
|
|
|
|
|
arguments to <SAMP>main()</SAMP>. The words have any characters
|
|
|
|
|
that
|
|
|
|
|
are 'active' in the Bourne shell escaped with a backslash.
|
|
|
|
|
If the value of the QUERY_STRING
|
|
|
|
|
metavariable
|
|
|
|
|
contains an unencoded equals-sign '=', then the command line
|
|
|
|
|
SHOULD NOT be used by the script.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><STRONG>The current working directory</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The current working directory for the script
|
|
|
|
|
SHOULD be set to the directory
|
|
|
|
|
containing the script.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><STRONG>Character set</STRONG>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>
|
|
|
|
|
<P>
|
|
|
|
|
The US-ASCII character set is used for the definition of environment
|
|
|
|
|
variable names and header field names; the newline (NL) sequence is LF;
|
|
|
|
|
servers SHOULD also accept CR LF as a newline.
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="11.0">
|
|
|
|
|
11. Security Considerations
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="11.1">
|
|
|
|
|
11.1. Safe Methods
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
As discussed in the security considerations of the HTTP
|
|
|
|
|
specifications [<A HREF="#[3]">3</A>,<A HREF="#[8]">8</A>], the
|
2007-03-20 11:30:28 +00:00
|
|
|
convention has been established that the
|
2007-02-11 14:52:07 +00:00
|
|
|
GET and HEAD methods should be 'safe'; they should cause no
|
|
|
|
|
side-effects and only have the significance of resource retrieval.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
CGI scripts are responsible for enforcing any HTTP security considerations
|
|
|
|
|
[<A HREF="#[3]">3</A>,<A HREF="#[8]">8</A>]
|
|
|
|
|
with respect to the protocol version level of the request and
|
|
|
|
|
any side effects generated by the scripts on behalf of
|
|
|
|
|
the server. Primary
|
|
|
|
|
among these
|
|
|
|
|
are the considerations of safe and idempotent methods. Idempotent
|
|
|
|
|
requests are those that may be repeated an arbitrary number of times
|
|
|
|
|
and produce side effects identical to a single request.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="11.2">
|
|
|
|
|
11.2. HTTP Header
|
|
|
|
|
Fields Containing Sensitive Information
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
Some HTTP header fields may carry sensitive information which the server
|
|
|
|
|
SHOULD NOT pass on to the script unless explicitly configured to do
|
|
|
|
|
so. For example, if the server protects the script using the
|
|
|
|
|
"<SAMP>Basic</SAMP>"
|
|
|
|
|
authentication scheme, then the client will send an
|
|
|
|
|
"<SAMP>Authorization</SAMP>"
|
|
|
|
|
header field containing a username and password. If the server, rather
|
|
|
|
|
than the script, validates this information then the password SHOULD
|
|
|
|
|
NOT be passed on to the script <EM>via</EM> the HTTP_AUTHORIZATION
|
|
|
|
|
metavariable
|
|
|
|
|
without careful consideration.
|
|
|
|
|
This also applies to the
|
|
|
|
|
Proxy-Authorization header field and the corresponding
|
|
|
|
|
HTTP_PROXY_AUTHORIZATION
|
|
|
|
|
metavariable.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="11.3">
|
|
|
|
|
11.3. Script
|
|
|
|
|
Interference with the Server
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The most common implementation of CGI invokes the script as a child
|
|
|
|
|
process using the same user and group as the server process. It
|
|
|
|
|
SHOULD therefore be ensured that the script cannot interfere with the
|
|
|
|
|
server process, its configuration, or documents.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
If the script is executed by calling a function linked in to the
|
|
|
|
|
server software (either at compile-time or run-time) then precautions
|
|
|
|
|
SHOULD be taken to protect the core memory of the server, or to
|
|
|
|
|
ensure that untrusted code cannot be executed.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H3>
|
|
|
|
|
<A NAME="11.4">
|
|
|
|
|
11.4. Data Length and Buffering Considerations
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
This specification places no limits on the length of message-bodies
|
|
|
|
|
presented to the script. Scripts should not assume that statically
|
|
|
|
|
allocated buffers of any size are sufficient to contain the entire
|
|
|
|
|
submission at one time. Use of a fixed length buffer without careful
|
|
|
|
|
overflow checking may result in an attacker exploiting 'stack-smashing'
|
|
|
|
|
or 'stack-overflow' vulnerabilities of the operating system.
|
|
|
|
|
Scripts may spool large submissions to disk or other buffering media,
|
|
|
|
|
but a rapid succession of large submissions may result in denial of
|
|
|
|
|
service conditions. If the CONTENT_LENGTH of a message-body is larger
|
|
|
|
|
than resource considerations allow, scripts should respond with an
|
|
|
|
|
error status appropriate for the protocol version; potentially applicable
|
|
|
|
|
status codes include '503 Service Unavailable' (HTTP/1.0 and HTTP/1.1),
|
|
|
|
|
'413 Request Entity Too Large' (HTTP/1.1), and
|
|
|
|
|
'414 Request-URI Too Long' (HTTP/1.1).
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H3>
|
|
|
|
|
<A NAME="11.5">
|
|
|
|
|
11.5. Stateless Processing
|
|
|
|
|
</A>
|
|
|
|
|
</H3>
|
|
|
|
|
<P>
|
|
|
|
|
The stateless nature of the Web makes each script execution and resource
|
|
|
|
|
retrieval independent of all others even when multiple requests constitute a
|
|
|
|
|
single conceptual Web transaction. Because of this, a script should not
|
|
|
|
|
make any assumptions about the context of the user-agent submitting a
|
|
|
|
|
request. In particular, scripts should examine data obtained from the client
|
|
|
|
|
and verify that they are valid, both in form and content, before allowing
|
|
|
|
|
them to be used for sensitive purposes such as input to other
|
|
|
|
|
applications, commands, or operating system services. These uses
|
|
|
|
|
include, but are not
|
|
|
|
|
limited to: system call arguments, database writes, dynamically evaluated
|
|
|
|
|
source code, and input to billing or other secure processes. It is important
|
|
|
|
|
that applications be protected from invalid input regardless of whether
|
|
|
|
|
the invalidity is the result of user error, logic error, or malicious action.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Authors of scripts involved in multi-request transactions should be
|
|
|
|
|
particularly cautios about validating the state information;
|
|
|
|
|
undesirable effects may result from the substitution of dangerous
|
|
|
|
|
values for portions of the submission which might otherwise be
|
|
|
|
|
presumed safe. Subversion of this type occurs when alterations
|
|
|
|
|
are made to data from a prior stage of the transaction that were
|
|
|
|
|
not meant to be controlled by the client (<EM>e.g.</EM>, hidden
|
|
|
|
|
HTML form elements, cookies, embedded URLs, <EM>etc.</EM>).
|
|
|
|
|
</P>
|
|
|
|
|
|
|
|
|
|
<H2>
|
|
|
|
|
<A NAME="12.0">
|
|
|
|
|
12. Acknowledgements
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<P>
|
|
|
|
|
This work is based on a draft published in 1997 by David R. Robinson,
|
|
|
|
|
which in turn was based on the original CGI interface that arose out of
|
|
|
|
|
discussions on the <EM>www-talk</EM> mailing list. In particular,
|
|
|
|
|
Rob McCool, John Franks, Ari Luotonen,
|
|
|
|
|
George Phillips and
|
|
|
|
|
Tony Sanders deserve special recognition for their efforts in
|
|
|
|
|
defining and implementing the early versions of this interface.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
This document has also greatly benefited from the comments and
|
|
|
|
|
suggestions made by Chris Adie, Dave Kristol,
|
|
|
|
|
Mike Meyer, David Morris, Jeremy Madea,
|
|
|
|
|
Patrick M<SUP>c</SUP>Manus, Adam Donahue,
|
|
|
|
|
Ross Patterson, and Harald Alvestrand.
|
|
|
|
|
</P>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="13.0">
|
|
|
|
|
13. References
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<DL COMPACT>
|
|
|
|
|
<DT><A NAME="[1]">[1]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Berners-Lee, T., 'Universal Resource Identifiers in WWW: A
|
|
|
|
|
Unifying Syntax for the Expression of Names and Addresses of
|
|
|
|
|
Objects on the Network as used in the World-Wide Web', RFC 1630,
|
|
|
|
|
CERN, June 1994.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[2]">[2]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Berners-Lee, T. and Connolly, D., 'Hypertext Markup Language -
|
|
|
|
|
2.0', RFC 1866, MIT/W3C, November 1995.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[3]">[3]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Berners-Lee, T., Fielding, R. T. and Frystyk, H.,
|
|
|
|
|
'Hypertext Transfer Protocol -- HTTP/1.0', RFC 1945, MIT/LCS,
|
|
|
|
|
UC Irvine, May 1996.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
|
|
|
|
|
<DT><A NAME="[4]">[4]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Berners-Lee, T., Fielding, R., and Masinter, L., Editors,
|
|
|
|
|
'Uniform Resource Identifiers (URI): Generic Syntax', RFC 2396,
|
|
|
|
|
MIT, U.C. Irvine, Xerox Corporation, August 1996.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
|
|
|
|
|
<DT><A NAME="[5]">[5]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Braden, R., Editor, 'Requirements for Internet Hosts --
|
|
|
|
|
Application and Support', STD 3, RFC 1123, IETF, October 1989.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[6]">[6]</A>
|
|
|
|
|
</DT>
|
2007-03-20 11:30:28 +00:00
|
|
|
<DD>Crocker, D.H., 'Standard for the Format of ARPA Internet Text
|
2007-02-11 14:52:07 +00:00
|
|
|
Messages', STD 11, RFC 822, University of Delaware, August 1982.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[7]">[7]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Fielding, R., 'Relative Uniform Resource Locators', RFC 1808,
|
|
|
|
|
UC Irvine, June 1995.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[8]">[8]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Fielding, R., Gettys, J., Mogul, J., Frystyk, H. and
|
|
|
|
|
Berners-Lee, T., 'Hypertext Transfer Protocol -- HTTP/1.1',
|
|
|
|
|
RFC 2068, UC Irvine, DEC,
|
|
|
|
|
MIT/LCS, January 1997.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[9]">[9]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Freed, N. and Borenstein N., 'Multipurpose Internet Mail
|
|
|
|
|
Extensions (MIME) Part Two: Media Types', RFC 2046, Innosoft,
|
|
|
|
|
First Virtual, November 1996.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[10]">[10]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Mockapetris, P., 'Domain Names - Concepts and Facilities',
|
|
|
|
|
STD 13, RFC 1034, ISI, November 1987.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[11]">[11]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>St. Johns, M., 'Identification Protocol', RFC 1431, US
|
|
|
|
|
Department of Defense, February 1993.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[12]">[12]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>'Coded Character Set -- 7-bit American Standard Code for
|
|
|
|
|
Information Interchange', ANSI X3.4-1986.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
<DT><A NAME="[13]">[13]</A>
|
|
|
|
|
</DT>
|
|
|
|
|
<DD>Hinden, R. and Deering, S.,
|
|
|
|
|
'IP Version 6 Addressing Architecture', RFC 2373,
|
|
|
|
|
Nokia, Cisco Systems,
|
|
|
|
|
July 1998.
|
|
|
|
|
<P>
|
|
|
|
|
</P>
|
|
|
|
|
</DD>
|
|
|
|
|
</DL>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
<H2>
|
|
|
|
|
<A NAME="14.0">
|
|
|
|
|
14. Authors' Addresses
|
|
|
|
|
</A>
|
|
|
|
|
</H2>
|
|
|
|
|
<ADDRESS>
|
|
|
|
|
<P>
|
|
|
|
|
Ken A L Coar
|
|
|
|
|
<BR>
|
|
|
|
|
MeepZor Consulting
|
|
|
|
|
<BR>
|
|
|
|
|
7824 Mayfaire Crest Lane, Suite 202
|
|
|
|
|
<BR>
|
|
|
|
|
Raleigh, NC 27615-4875
|
|
|
|
|
<BR>
|
|
|
|
|
U.S.A.
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Tel: +1 (919) 254.4237
|
|
|
|
|
<BR>
|
|
|
|
|
Fax: +1 (919) 254.5250
|
|
|
|
|
<BR>
|
|
|
|
|
Email:
|
|
|
|
|
<A
|
|
|
|
|
HREF="mailto:Ken.Coar@Golux.Com"
|
|
|
|
|
><SAMP>Ken.Coar@Golux.Com</SAMP></A>
|
|
|
|
|
</P>
|
|
|
|
|
</ADDRESS>
|
|
|
|
|
<ADDRESS>
|
|
|
|
|
<P>
|
|
|
|
|
David Robinson
|
|
|
|
|
<BR>
|
|
|
|
|
E*TRADE UK Ltd
|
|
|
|
|
<BR>
|
|
|
|
|
Mount Pleasant House
|
|
|
|
|
<BR>
|
|
|
|
|
2 Mount Pleasant
|
|
|
|
|
<BR>
|
|
|
|
|
Huntingdon Road
|
|
|
|
|
<BR>
|
|
|
|
|
Cambridge CB3 0RN
|
|
|
|
|
<BR>
|
|
|
|
|
UK
|
|
|
|
|
</P>
|
|
|
|
|
<P>
|
|
|
|
|
Tel: +44 (1223) 566926
|
|
|
|
|
<BR>
|
|
|
|
|
Fax: +44 (1223) 506288
|
|
|
|
|
<BR>
|
|
|
|
|
Email:
|
|
|
|
|
<A
|
|
|
|
|
HREF="mailto:drtr@etrade.co.uk"
|
|
|
|
|
><SAMP>drtr@etrade.co.uk</SAMP></A>
|
|
|
|
|
</ADDRESS>
|
2007-03-20 11:30:28 +00:00
|
|
|
|
2007-02-11 14:52:07 +00:00
|
|
|
</BODY>
|
|
|
|
|
</HTML>
|
