AWS + ECP?

[Brent Putman]

On 2/4/16 7:03 PM, Cantor, Scott wrote:
> Formally speaking, ECP is SOAP and requires that content type. 

Yes, I was going to bring that up. It's technically not valid for a
SOAP/ECP client to not send that.

> Practically speaking, the decoding class doesn't check, and sending
> anything that doesn't get in the way will work (I tested with foo/bar,
> worked fine).

Yes, it was pretty much ported over from V2 as-is, and it never checked
content type.  I guess we were adopting the "be permissive in what you
accept" rule of internet programming.  We could actively enforce the
type.  However, that leads to the opposite problem: breaking people who
currently don't send anything, or who send the wrong thing.  Don't know
which is preferable...

> I believe the SP is pretty strict about that stuff, just because I
> don't like having C/C++ code operating on unknown data if I can avoid it.

Philosophically, I agree.  Just pointing out, though, that just because
the request carries a Content-Type doesn't mean it actually *is* that
type.  Could be broken or lying.  Which is exactly what curl seems to do
by default, i.e. I don't think a naked SOAP Envelope is syntactically
(at least not semantically) valid application/x-www-form-urlencoded (not
param/value pairs).

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/6c37e6ba/attachment.html>