[cpp-sp] 01/02: Clean up comment

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=bfe2670b0c94ff1134a39427b96c569523aee895

commit bfe2670b0c94ff1134a39427b96c569523aee895
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed May 28 14:56:38 2025 +0100

    Clean up comment
---
 shibsp/remoting/impl/WinHTTPRemotingService.cpp | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/shibsp/remoting/impl/WinHTTPRemotingService.cpp b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
index 4384f3d8..bc0943fc 100644
--- a/shibsp/remoting/impl/WinHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
@@ -373,18 +373,21 @@ void WinHTTPRemotingService::send(const char* path, istream& input, ostream& out
     //  The flags we set https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-httpspolicycallbackdata
     //      SECURITY_FLAG_IGNORE_UNKNOWN_CA   Ignore errors associated with an unknown certification authority.
     //                                        We check this in WinHTTPRemotingService::handleCert
-    //      SECURITY_FLAG_IGNORE_WRONG_USAGE  Ignore errors associated with the use of a certificate.
-    //      SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
-    //                                        Ignore errors associated with an expired certificate.
     //
     // Critically we do NOT set
-    //      SECURITY_FLAG_IGNORE_CERT_CN_INVALID Ignore errors associated with a certificate that contains a common name that is not valid.
-    //      SECURITY_FLAG_IGNORE_REVOCATION      Ignore errors associated with a revoked certificate.
-    //                                           We need to add this (and in WinHTTPRemotingService::handleCert)
+    //      SECURITY_FLAG_IGNORE_WRONG_USAGE
+    //                   Ignore errors associated with the use of a certificate.
+    //      SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
+    //                   Ignore errors associated with an expired certificate.
+    //      SECURITY_FLAG_IGNORE_CERT_CN_INVALID
+    //                   Ignore errors associated with a certificate that contains a common name that is not valid.
     //
-    DWORD securityFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA |
-                          SECURITY_FLAG_IGNORE_CERT_WRONG_USAGE |
-                          SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
+    // We (will) selectively set
+    //      SECURITY_FLAG_IGNORE_REVOCATION
+    //                    Ignore errors associated with a revoked certificate.
+    //
+    DWORD securityFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA;
+
     if (!WinHttpSetOption(request, WINHTTP_OPTION_SECURITY_FLAGS, &securityFlags, sizeof(securityFlags))) {
         m_log.crit("Send.  Failed to set security flags : %d", GetLastError());
         throw RemotingException("Send failed");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.