WebLogic, headers, and preventing spoofing

[Scott Koranda]

Hello,

To integrate an application that runs inside WebLogic (itself proxied
by OHS) I am using headers instead of Apache/OHS environment variables
to pass attribute values from the SP.

I am aware of the risks as clearly stated at

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPInProcess

and in other places in the wiki.

I am mitigating those risks, in part, by using the SP checkSpoofing option.

I am also considering further mitigating those risks by configuring
the load balancer appliance in front of the OHS/WebLogic/SP node(s) to
also block headers that should only be set by the SP.

I would be grateful to hear from any others that have taken this
additional step for similar scenarios and whether you found any
problems or issues with it.

Thanks,

Scott K