CGI, SCGI and Certificates (was Re: [ANN] Gemini browser for iOS)

[Michael Lazar]

On Thu, Jun 11, 2020 at 1:58 PM solderpunk <solderpunk at sdf.org> wrote:
>
> On Tue, Jun 09, 2020 at 09:02:24PM -0400, Michael Lazar wrote:
>
> > I believe this is using SCRIPT_NAME incorrectly per RFC 3875. The SCRIPT_NAME
> > should be the part of the URI path that comes before the PATH_INFO [1]. So in
> > your example:
> >
> > GEMINI_URL=gemini://lucy.roswell.area51/cgi-bin/beta/foobar?one=1&two=2
> > SCRIPT_NAME=/cgi-bin/beta
> > PATH_INFO=/foobar
>
> Is this how cgi-bins are traditionally handled?  If a URI paths's prefix
> matches the configured cgi-bin path, the standard mapping from URI paths
> to the filesystem is interrupted, and the first component of the URI path
> *after* the cgi-bin prefix (here `beta`) is the only think looked for on
> the disk, with everything else passed along to PATH_INFO?  If there is,
> for example, a /var/gemini/cgi-bin/beta/ directory on the disk, the
> server does not check for an executable named `foobar` in it?

Yes, but it's not limited to only the first component after cgi-bin/. The way
jetforce is implemented (thanks to a PR by arxcode [0]) is that it will walk
through the URI path on the filesystem until it reaches an executable file.
Then, anything left over is attached to the PATH_INFO. These two are both valid:

gemini://mozz.us/cgi-bin/debug.cgi/extra/path/info
-> /var/gemini/cgi-bin/debug.cgi

gemini://mozz.us/cgi-bin/directory/debug.cgi/extra/path/info
-> /var/gemini/cgi-bin/directory/debug.cgi

[0] https://github.com/michael-lazar/jetforce/issues/16