displaying server variables in IIS

[Cantor, Scott]

On 2/27/20, 1:38 PM, "dev on behalf of Doan, Tommy" <dev-bounces at shibboleth.net on behalf of tdoan at smu.edu> wrote:

> The Shibboleth SP 3 documentation about accessing server variables from IIS mentions that looping through them 
> fails to display the ones added by the SP.

Even if ASP.NET works, ASP probably doesn’t, but every single IIS server seems to be different, they don't behave consistently. So the issue is more that it shouldn't be depended on.

Further, it's a security risk to expose that *if* you're relying on headers because you're going to expose the random spoofcheck string that prevents header smuggling.

-- Scott