disclosure of IP address in cookie

[Cantor, Scott]

> Note that Univie also runs the Shib IdP within Tomcat and Tomcat
> behind httpd with mod_proxy_ajp (and there's even a load balancer in
> front, terminating TLS/SSL).
> All client IP addresses show up as usual.
> I don't have access to the setup anymore but I don't think we had to
> do anything special.

mod_proxy_ajp, which is the intended approach, will work without any trouble. mod_proxy_http will not, without adding a filter (unless Tomcat happens to implement a look-aside option).

-- Scott