cgi_setenv("HTTP_IF_NONE_MATCH", zVal);
    }else if( fossil_strcmp(zFieldName,"if-modified-since:")==0 ){
      cgi_setenv("HTTP_IF_MODIFIED_SINCE", zVal);
    }else if( fossil_strcmp(zFieldName,"referer:")==0 ){
      cgi_setenv("HTTP_REFERER", zVal);
    }else if( fossil_strcmp(zFieldName,"user-agent:")==0 ){
      cgi_setenv("HTTP_USER_AGENT", zVal);
    }else if( fossil_strcmp(zFieldName,"authorization:")==0 ){
      cgi_setenv("HTTP_AUTHORIZATION", zVal);
    }else if( fossil_strcmp(zFieldName,"x-forwarded-for:")==0 ){
      const char *zIpAddr = cgi_accept_forwarded_for(zVal);
      if( zIpAddr!=0 ){
        g.zIpAddr = mprintf("%s", zIpAddr);
        cgi_replace_parameter("REMOTE_ADDR", g.zIpAddr);
      }
    }

  if( uid==0 ){
    const char *zRemoteUser = P("REMOTE_USER");
    if( zRemoteUser && db_get_boolean("remote_user_ok",0) ){
      uid = db_int(0, "SELECT uid FROM user WHERE login=%Q"
                      " AND length(cap)>0 AND length(pw)>0", zRemoteUser);
    }
  }

  /* If the request didn't provide a login cookie or the login cookie didn't
  ** match a known valid user, check the HTTP "Authorization" header and
  ** see if those credentials are valid for a known user.
  */
  if( uid==0 ){
    const char *zHTTPAuth = PD("HTTP_AUTHORIZATION", 0);

    /* Check to see if the HTTP "Authorization" header is present
    */
    if( zHTTPAuth!=0 && zHTTPAuth[0]!=0
     && db_get_boolean("http_authentication_ok",0)
    ){
      char *zBuf = fossil_strdup(zHTTPAuth);

      if( zBuf!=0 ){
        char *zPos;
        char *zTok = strtok_r(zBuf, " ", &zPos);

        if( zTok != 0 ){
          /* Check to see if the authorization scheme is HTTP
          ** basic auth.
          */
          if (strncmp(zTok, "Basic", zTok - zBuf) == 0) {
            zTok = strtok_r(NULL, " ", &zPos);
            int zBytesDecoded = 0;
            char *zDecodedAuth = decode64(zTok, &zBytesDecoded);

            char *zUsername = strtok_r(zDecodedAuth, ":", &zPos);
            char *zPasswd = strtok_r(NULL, ":", &zPos);

            if( zUsername!=0 && zPasswd!=0 && zPasswd[0]!=0 ){
              /* Attempting to log in as the user provided by HTTP
              ** basic auth
              */
              uid = login_search_uid(zUsername, zPasswd);
              if( uid>0 ){
                record_login_attempt(zUsername, zIpAddr, 1);
              }else{
                record_login_attempt(zUsername, zIpAddr, 0);

                /* The user attempted to login specifically with HTTP basic
                ** auth, but provided invalid credentials. Inform them of
                ** the failed login attempt via 401.
                */
                cgi_set_status(401, "Unauthorized");
                cgi_reply();
                fossil_exit(0);
              }
            }

            fossil_free(zDecodedAuth);
          }
        }

        fossil_free(zBuf);
      }
    }
  }

  /* If no user found yet, try to log in as "nobody" */
  if( uid==0 ){
    uid = db_int(0, "SELECT uid FROM user WHERE login='nobody'");
    if( uid==0 ){
      /* If there is no user "nobody", then make one up - with no privileges */
      uid = -1;

  @ <hr />
  onoff_attribute("Allow REMOTE_USER authentication",
     "remote_user_ok", "remote_user_ok", 0, 0);
  @ <p>When enabled, if the REMOTE_USER environment variable is set to the
  @ login name of a valid user and no other login credentials are available,
  @ then the REMOTE_USER is accepted as an authenticated user.
  @ </p>
  @
  @ <hr />
  onoff_attribute("Allow HTTP_AUTHENTICATION authentication",
     "http_authentication_ok", "http_authentication_ok", 0, 0);
  @ <p>When enabled, allow the use of the HTTP_AUTHENTICATION environment
  @ variable or the "Authentication:" HTTP header to find the username and
  @ password. This is another way of supporting Basic Authenitication.
  @ </p>
  @
  @ <hr />
  entry_attribute("IP address terms used in login cookie", 3,
                  "ip-prefix-terms", "ipt", "2", 0);
  @ <p>The number of octets of of the IP address used in the login cookie.
  @ Set to zero to omit the IP address from the login cookie.  A value of
  @ 2 is recommended.