Difference between AUTH_USER and REMOTE_USER cgi variables

Difference between AUTH_USER and REMOTE_USER cgi variables

The docs aren't entirely clear on this - is there a difference between these variables? On IIS at least they appear to be identical, but I don't want to rely on that if it might be different under other servers.

IIS 6 compression configuration as told by Jeff


detecting the presence and version of IIS using MSBuild
According to the Adobe ColdFusion documentation they are the same.

How to create a job in IIS capable of running an extended process
File Security (IP address access restrictions) in IIS7
Windows IIS test server setup
Looking at the openbd source code, the remote_user and the auth_user are mapped to the same key, so it returns the same value..
How to configure multiple intranet website on server 2003?
Looking at the railo source code, I'm not quite understanding what is going on, but it appears to be setting remote_user, and I'm not sure if auth_user is being set anywhere..
Dojo load time extremely slow on iis
If you are designing an app that is compatible with coldfusion, railo, and openbd, it appears safer to use remote_user.

bypass IIS xml file settings at file/folder level
Maybe someone else can comment because I don't fully understand the code without taking the time to investigate deeply..


REMOTE_USER and AUTH_USER will be the same in AdobeCF/IIS, but not on AdobeCF/Apache.

AUTH_USER will be blank when using AdobeCF/Apache.

. So it is best to code using the REMOTE_USER variable.

If you find yourself working on code that references AUTH_USER in Apache, there is a way to make Apache populate that variable using mod_rewrite.

This will cause Apache to copy REMOTE_USER into AUTH_USER:. RewriteEngine on RewriteCond %{REMOTE_USER} (.) RewriteRule . - [E=AUTH_USER:%1]. There is more info here: http://www.stillnetstudios.com/copying-env-variables-in-apache/.


I'm fairly sure REMOTE_USER is the standard CGI variable.. According to this page, they are the same: http://livedocs.adobe.com/coldfusion/6/CFML_Reference/Expressions5.htm.


to be on the safe side stick to REMOTE_USER as it is the one defined in the CGI/1.0 spec (Found here http://www.ietf.org/rfc/rfc3875). AUTH_USER seems to have snuck in over time.


In my experience, CGI variables tend to differ between Web Servers (Apache, IIS, JRun, etc), and even between their versions.

The only safe bet, when basing something on a CGI variable, is to check what values show up on your dev, stage, production (etc) servers..

92 out of 100 based on 72 user ratings 572 reviews