AJP proxy of request environment

[Chad La Joie]

On Fri, Jul 20, 2012 at 5:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 7/20/12 5:40 PM, "Chad La Joie" <lajoie at itumi.biz> wrote:
>>>
>>> I wouldn't say "same", but I use headers if I have to just like anybody
>>> else. The wiki and jira use it at the moment because of the plugin
>>> limitations and I haven't deemed it worth trying to fix the plugins.
>>
>>I'm curious what you think the difference is, other than the obvious
>>binary vs text difference.
>
> Preventing header spoofing is very difficult, takes a lot of fragile code,
> and has already been compromised once because of an IIS quirk.
>
> I routinely attack and attempt to exploit that code, and I can't manage
> it, but I don't have the kind of confidence that would lead me to suggest
> using it if one didn't have to.
>
> Using the environment is simply not attackable. Nothing to spoof.

None of that really has anything to do with which protocol is used to
send the data from the webserver to the container, however.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered