AJP proxy of request environment

[Cantor, Scott]

On 7/20/12 5:40 PM, "Chad La Joie" <lajoie at itumi.biz> wrote:
>>
>> I wouldn't say "same", but I use headers if I have to just like anybody
>> else. The wiki and jira use it at the moment because of the plugin
>> limitations and I haven't deemed it worth trying to fix the plugins.
>
>I'm curious what you think the difference is, other than the obvious
>binary vs text difference.

Preventing header spoofing is very difficult, takes a lot of fragile code,
and has already been compromised once because of an IIS quirk.

I routinely attack and attempt to exploit that code, and I can't manage
it, but I don't have the kind of confidence that would lead me to suggest
using it if one didn't have to.

Using the environment is simply not attackable. Nothing to spoof.

The other risk comes in when you hit an application layer that tries to
unify the two. There aren't a lot, but definitely some try to some extent,
and that's definitely a problem. Java doesn't, of course.

-- Scott