WebLogic, headers, and preventing spoofing

[Scott Koranda]

On Fri, Sep 27, 2013 at 6:41 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 9/27/13 6:26 AM, "Scott Koranda" <skoranda at gmail.com> wrote:
>>
>>I am mitigating those risks, in part, by using the SP checkSpoofing
>>option.
>
> The practical risk is very small on Apache, because it uses a
> straightforward set of rules to transform headers into the environment. I
> replicated those rules in order to implement the module.
>
> IIS is different in that it's closed source *and* has gravely serious bugs
> related to punctuation in headers that they have gone to some lengths to
> defend as "reasonable". So it's somewhat impossible to know for 100%
> certainty what's safe and what isn't.
>
>>I am also considering further mitigating those risks by configuring
>>the load balancer appliance in front of the OHS/WebLogic/SP node(s) to
>>also block headers that should only be set by the SP.
>
> That seems like a cool idea, but I suspect potentially difficult in
> practice because you would have to block every possible header that could
> transform itself into the right variable name.

I am sorry. I do not understand.

Can you provide an example of how a header could transform itself
into, for example, 'eppn' if it is not sent by a malicious client as
'eppn'?

Thanks,

Scott K