WebLogic, headers, and preventing spoofing

[Cantor, Scott]

On 10/1/13 9:24 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>
>Can you provide an example of how a header could transform itself
>into, for example, 'eppn' if it is not sent by a malicious client as
>'eppn'?

Mainly case folding, if you're not using any punctuation in the header
name.

With Apache, the following request headers will all become HTTP_EPPN:

EPPN:
eppn:
ePpn:

and so on. Now consider a longer name and how ugly it gets.

When punctuation is included, any non-alphanum will become '_', so
including that in your header mapping will greatly expand the set.

Basically, if you're trying to "unset" headers, you have a fairly
impossible task. The SP doesn't do that, it actually sets an empty one.
Whether that would work from outside the Apache process I couldn't say.

-- Scott