WebLogic, headers, and preventing spoofing

[Scott Koranda]

On Tue, Oct 1, 2013 at 6:43 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/1/13 9:24 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>>
>>Can you provide an example of how a header could transform itself
>>into, for example, 'eppn' if it is not sent by a malicious client as
>>'eppn'?
>
> Mainly case folding, if you're not using any punctuation in the header
> name.
>
> With Apache, the following request headers will all become HTTP_EPPN:
>
> EPPN:
> eppn:
> ePpn:
>
> and so on. Now consider a longer name and how ugly it gets.

Understood, but the load balancer already has the logic to match
any of the above.

I am not a load balancer appliance expert but the model I have to work
with can match any of the above with
a single rule (the difficult/impossible part would be distinguishing
between them).

Once matched, the request can be rejected entirely.

>
> When punctuation is included, any non-alphanum will become '_', so
> including that in your header mapping will greatly expand the set.
>
> Basically, if you're trying to "unset" headers, you have a fairly
> impossible task.

I don't want to "unset" or remove a header, just completely reject a
request if it contains
any variation of 'eppn'.

Thanks,

Scott K

P.S. The appliance also has a "sanitize" mode that drops all headers
except for a whitelisted set. That functionality might also be useful
in this context.