[cpp-sp] branch main updated: Convert Apache specific redirect expiration to content setting.
Scott Cantor
cantor.2 at osu.edu
Wed Jul 30 15:42:54 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=3b134cc72ee09baf2197af5014dcb0bc0ce5a8ff
The following commit(s) were added to refs/heads/main by this push:
new 3b134cc7 Convert Apache specific redirect expiration to content setting.
3b134cc7 is described below
commit 3b134cc72ee09baf2197af5014dcb0bc0ce5a8ff
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jul 30 11:42:49 2025 -0400
Convert Apache specific redirect expiration to content setting.
---
apache/mod_shib_24.cpp | 13 +++++--------
fastcgi/shibauthorizer.cpp | 9 ++++++---
fastcgi/shibresponder.cpp | 9 ++++++---
iis7_shib/IIS7Request.cpp | 9 +++++++--
shibsp/RequestMapper.h | 24 +++++++++++++-----------
shibsp/impl/XMLRequestMapper.cpp | 2 ++
6 files changed, 39 insertions(+), 27 deletions(-)
diff --git a/apache/mod_shib_24.cpp b/apache/mod_shib_24.cpp
index a2bf2f53..a5c0db70 100644
--- a/apache/mod_shib_24.cpp
+++ b/apache/mod_shib_24.cpp
@@ -152,7 +152,6 @@ struct shib_dir_config
// Dedicated content Configuration
int bOff; // flat-out disable all Shib processing
int bBasicHijack; // activate for AuthType Basic?
- int bExpireRedirects; // expire redirects?
};
// creates per-directory config structure
@@ -164,7 +163,6 @@ extern "C" void* create_shib_dir_config (apr_pool_t* p, char*)
dc->bRequestMapperAuthz = -1;
dc->bOff = -1;
dc->bBasicHijack = -1;
- dc->bExpireRedirects = -1;
return dc;
}
@@ -223,7 +221,6 @@ extern "C" void* merge_shib_dir_config (apr_pool_t* p, void* base, void* sub)
dc->bOff = ((child->bOff == -1) ? parent->bOff : child->bOff);
dc->bBasicHijack = ((child->bBasicHijack == -1) ? parent->bBasicHijack : child->bBasicHijack);
- dc->bExpireRedirects = ((child->bExpireRedirects==-1) ? parent->bExpireRedirects : child->bExpireRedirects);
return dc;
}
@@ -518,12 +515,15 @@ public:
return DONE;
}
long sendRedirect(const char* url) {
- HTTPResponse::sendRedirect(url);
+ HTTPResponse::sendRedirect(url);
apr_table_set(m_req->headers_out, "Location", url);
- if (m_dc->bExpireRedirects != 0) {
+
+ if (getRequestSettings().first->getBool(
+ RequestMapper::EXPIRE_REDIRECTS_PROP_NAME, RequestMapper::EXPIRE_REDIRECTS_PROP_DEFAULT)) {
apr_table_set(m_req->err_headers_out, "Expires", "Wed, 01 Jan 1997 12:00:00 GMT");
apr_table_set(m_req->err_headers_out, "Cache-Control", "private,no-store,no-cache,max-age=0");
}
+
return HTTP_MOVED_TEMPORARILY;
}
long returnDecline(void) { return DECLINED; }
@@ -1559,9 +1559,6 @@ static command_rec shib_cmds[] = {
OR_AUTHCFG, "DEPRECATED: Export attributes using environment variables"),
AP_INIT_TAKE1("ShibUseHeaders", (config_fn_t)shib_deprecated_table_set, nullptr,
OR_AUTHCFG, "DEPRECATED: Export attributes using custom HTTP headers"),
- AP_INIT_FLAG("ShibExpireRedirects", (config_fn_t)ap_set_flag_slot,
- (void *) offsetof (shib_dir_config, bExpireRedirects),
- OR_AUTHCFG, "Expire SP-generated redirects"),
{nullptr}
};
diff --git a/fastcgi/shibauthorizer.cpp b/fastcgi/shibauthorizer.cpp
index 78bc3ccf..8f6191bf 100644
--- a/fastcgi/shibauthorizer.cpp
+++ b/fastcgi/shibauthorizer.cpp
@@ -224,9 +224,12 @@ public:
HTTPResponse::sendRedirect(url);
string hdr=string("Status: 302 Please Wait\r\nLocation: ") + url + "\r\n"
"Content-Type: text/html\r\n"
- "Content-Length: 40\r\n"
- "Expires: Wed, 01 Jan 1997 12:00:00 GMT\r\n"
- "Cache-Control: private,no-store,no-cache,max-age=0\r\n";
+ "Content-Length: 40\r\n";
+ if (getRequestSettings().first->getBool(
+ RequestMapper::EXPIRE_REDIRECTS_PROP_NAME, RequestMapper::EXPIRE_REDIRECTS_PROP_DEFAULT)) {
+ hdr += "Expires: Wed, 01 Jan 1997 12:00:00 GMT\r\n"
+ "Cache-Control: private,no-store,no-cache,max-age=0\r\n";
+ }
for (multimap<string,string>::const_iterator i=m_response_headers.begin(); i!=m_response_headers.end(); ++i)
hdr += i->first + ": " + i->second + "\r\n";
hdr += "\r\n";
diff --git a/fastcgi/shibresponder.cpp b/fastcgi/shibresponder.cpp
index 14096060..159f0f41 100644
--- a/fastcgi/shibresponder.cpp
+++ b/fastcgi/shibresponder.cpp
@@ -186,9 +186,12 @@ public:
HTTPResponse::sendRedirect(url);
string hdr=string("Status: 302 Please Wait\r\nLocation: ") + url + "\r\n"
"Content-Type: text/html\r\n"
- "Content-Length: 40\r\n"
- "Expires: Wed, 01 Jan 1997 12:00:00 GMT\r\n"
- "Cache-Control: private,no-store,no-cache,max-age=0\r\n";
+ "Content-Length: 40\r\n";
+ if (getRequestSettings().first->getBool(
+ RequestMapper::EXPIRE_REDIRECTS_PROP_NAME, RequestMapper::EXPIRE_REDIRECTS_PROP_DEFAULT)) {
+ hdr += "Expires: Wed, 01 Jan 1997 12:00:00 GMT\r\n"
+ "Cache-Control: private,no-store,no-cache,max-age=0\r\n";
+ }
for (multimap<string,string>::const_iterator i=m_response_headers.begin(); i!=m_response_headers.end(); ++i)
hdr += i->first + ": " + i->second + "\r\n";
hdr += "\r\n";
diff --git a/iis7_shib/IIS7Request.cpp b/iis7_shib/IIS7Request.cpp
index d95c5cb6..8fa6611d 100644
--- a/iis7_shib/IIS7Request.cpp
+++ b/iis7_shib/IIS7Request.cpp
@@ -448,8 +448,13 @@ void IIS7Request::setResponseHeader(const char* name, const char* value, bool re
long IIS7Request::sendRedirect(const char* url)
{
HTTPResponse::sendRedirect(url);
- setResponseHeader("Expires", "Wed, 01 Jan 1997 12:00:00 GMT", true);
- setResponseHeader("Cache-Control", "private,no-store,no-cache,max-age=0", true);
+
+ if (getRequestSettings().first->getBool(
+ RequestMapper::EXPIRE_REDIRECTS_PROP_NAME, RequestMapper::EXPIRE_REDIRECTS_PROP_DEFAULT)) {
+ setResponseHeader("Expires", "Wed, 01 Jan 1997 12:00:00 GMT", true);
+ setResponseHeader("Cache-Control", "private,no-store,no-cache,max-age=0", true);
+ }
+
HRESULT hr = m_response->Redirect(url);
if (FAILED(hr)) {
logFatal("Redirect", hr);
diff --git a/shibsp/RequestMapper.h b/shibsp/RequestMapper.h
index 01ba17fe..dd402380 100644
--- a/shibsp/RequestMapper.h
+++ b/shibsp/RequestMapper.h
@@ -49,30 +49,32 @@ namespace shibsp {
typedef std::pair<const PropertySet*,AccessControl*> Settings;
static const char APPLICATION_ID_PROP_NAME[];
+ static const char ATTRIBUTE_CONFIG_ID_PROP_NAME[];
static const char AUTH_TYPE_PROP_NAME[];
+ static const char CONSISTENT_ADDRESS_PROP_NAME[];
+ static const char COOKIE_MAXAGE_PROP_NAME[];
+ static const char EXPIRE_REDIRECTS_PROP_NAME[];
+ static const char HANDLER_CONFIG_ID_PROP_NAME[];
+ static const char LIFETIME_PROP_NAME[];
+ static const char PRESERVE_POST_DATA_PROP_NAME[];
static const char REDIRECT_ERRORS_PROP_NAME[];
static const char REDIRECT_TO_SSL_PROP_NAME[];
static const char REQUIRE_SESSION_PROP_NAME[];
static const char REQUIRE_LOGOUT_WITH_PROP_NAME[];
- static const char HANDLER_CONFIG_ID_PROP_NAME[];
- static const char ATTRIBUTE_CONFIG_ID_PROP_NAME[];
- static const char SESSION_HOOK_PROP_NAME[];
- static const char LIFETIME_PROP_NAME[];
- static const char TIMEOUT_PROP_NAME[];
- static const char CONSISTENT_ADDRESS_PROP_NAME[];
- static const char COOKIE_MAXAGE_PROP_NAME[];
static const char SESSION_COOKIE_NAME_PROP_NAME[];
+ static const char SESSION_HOOK_PROP_NAME[];
static const char TARGET_PROP_NAME[];
- static const char PRESERVE_POST_DATA_PROP_NAME[];
+ static const char TIMEOUT_PROP_NAME[];
static const char USE_HEADERS_PROP_NAME[];
static const char USE_VARIABLES_PROP_NAME[];
static const char APPLICATION_ID_PROP_DEFAULT[];
- static bool REQUIRE_SESSION_PROP_DEFAULT;
- static unsigned int LIFETIME_PROP_DEFAULT;
- static unsigned int TIMEOUT_PROP_DEFAULT;
static bool CONSISTENT_ADDRESS_PROP_DEFAULT;
+ static bool EXPIRE_REDIRECTS_PROP_DEFAULT;
+ static unsigned int LIFETIME_PROP_DEFAULT;
static bool PRESERVE_POST_DATA_PROP_DEFAULT;
+ static bool REQUIRE_SESSION_PROP_DEFAULT;
+ static unsigned int TIMEOUT_PROP_DEFAULT;
static bool USE_HEADERS_PROP_DEFAULT;
static bool USE_VARIABLES_PROP_DEFAULT;
diff --git a/shibsp/impl/XMLRequestMapper.cpp b/shibsp/impl/XMLRequestMapper.cpp
index 0116dd87..8beb7f47 100644
--- a/shibsp/impl/XMLRequestMapper.cpp
+++ b/shibsp/impl/XMLRequestMapper.cpp
@@ -173,6 +173,7 @@ const char RequestMapper::AUTH_TYPE_PROP_NAME[] = "authType";
const char RequestMapper::CONSISTENT_ADDRESS_PROP_NAME[] = "consistentAddress";
const char RequestMapper::COOKIE_MAXAGE_PROP_NAME[] = "cookieMaxAge";
const char RequestMapper::HANDLER_CONFIG_ID_PROP_NAME[] = "handlerConfigId";
+const char RequestMapper::EXPIRE_REDIRECTS_PROP_NAME[] = "expireRedirects";
const char RequestMapper::LIFETIME_PROP_NAME[] = "lifetime";
const char RequestMapper::PRESERVE_POST_DATA_PROP_NAME[] = "preservePostData";
const char RequestMapper::REDIRECT_ERRORS_PROP_NAME[] = "redirectErrors";
@@ -188,6 +189,7 @@ const char RequestMapper::USE_VARIABLES_PROP_NAME[] = "useVariables";
const char RequestMapper::APPLICATION_ID_PROP_DEFAULT[] = "default";
bool RequestMapper::CONSISTENT_ADDRESS_PROP_DEFAULT = true;
+bool RequestMapper::EXPIRE_REDIRECTS_PROP_DEFAULT = true;
unsigned int RequestMapper::LIFETIME_PROP_DEFAULT = 3600 * 8;
bool RequestMapper::REQUIRE_SESSION_PROP_DEFAULT = false;
unsigned int RequestMapper::TIMEOUT_PROP_DEFAULT = 3600;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list