WebLogic, headers, and preventing spoofing

[Cantor, Scott]

On 9/27/13 6:26 AM, "Scott Koranda" <skoranda at gmail.com> wrote:
>
>I am mitigating those risks, in part, by using the SP checkSpoofing
>option.

The practical risk is very small on Apache, because it uses a
straightforward set of rules to transform headers into the environment. I
replicated those rules in order to implement the module.

IIS is different in that it's closed source *and* has gravely serious bugs
related to punctuation in headers that they have gone to some lengths to
defend as "reasonable". So it's somewhat impossible to know for 100%
certainty what's safe and what isn't.

>I am also considering further mitigating those risks by configuring
>the load balancer appliance in front of the OHS/WebLogic/SP node(s) to
>also block headers that should only be set by the SP.

That seems like a cool idea, but I suspect potentially difficult in
practice because you would have to block every possible header that could
transform itelf into the right variable name. The SP doesn't do this, it
actually examines each header before setting any and determines if any of
them will "become" the same variable name.

-- Scott