Lazy sessions and authorization (Drupal)

[Cantor, Scott]

On 10/28/13, 6:26 AM, "Kristof Bajnok" <bajnokk at niif.hu> wrote:

>On 2013-10-25 16:18, Cantor, Scott wrote:
>>> I will try that too, but the documentation also requires me to enable
>>> ShibUseHeaders which made me a bit wary of their advice and hoped
>>> somebody here has some experience.
>> 
>> If their code is reading headers only (which would be a bad thing), then
>> that advice is certainly necessary.
>
>PHP merges headers and environment into a single array ($_SERVER) and I
>don't know any non-deprecated way to access the environment only.

Ah. Then PHP itself has a pretty major bug.

>Anyone who can sort out mod_rewrite from their Drupal configuration, may
>safely disable ShibUseHeaders. Most of the users can not.

I'm sure.

Thank,
-- Scott