Robust way to access attributes

[Peter Schober]

* Kristof Bajnok <bajnokk at niif.hu> [2012-09-28 15:06]:
> Moreover, other web server modules can occasionally add certain prefixes
> to environment variables (or even headers? dunno) before the script gets
> them, like REDIRECT_ or AJP_, and this is where I start to get lost. I
> haven't find any specific documentation about which modules do like this
> and exactly under what circumstances. (If you have one, please share it!)

"REDIRECT_" get's added by mod_rewrite and involves subrequests, AFAIU.
How to safely handle that is a matter of discussion, I think.
How /not/ to do it, IMO, is by iterating over these and removing any
level of "REDIRECT_" prefixes from the attribute name, as I've seen
code do.

"AJP_" can be added by the Shib SP (any string, really) to accomodate
some servlet containers' (e.g. Apache Tomcat's) requirement of such a
prefix on all attribute names coming in via AJP in order to accept the
values as attributes.
So these are intended for use within a servlet container for which
the Shib SP provides protection and would appear without that prefix
as HTTP request attributes there.
Now if that same webserver with mod_shib and mod_proxy_ajp (or mod_jk)
also serves other applications itself (instead of tunneling everything
throw AJP), those attribute names would also have that prefix.
But the alias feature of the attribute-map.xml would allow to not use
the prefixed names within your applications. Or setting up additional
SP "applications" with/without that prefix.
-peter