AWS + ECP?

[Brent Putman]

On 2/4/16 9:45 PM, John Dennis wrote:
>
>
> Therefore since ECP requires SOAP 1.1 (not SOAP 1.2) and SOAP 1.1
> requires 'text/xml' and because RFC 3902 reserves
> 'application/soap+xml' for SOAP 1.2 the media type should be
> 'text/xml' not 'application/soap+xml'.

Yes, agree.  I don't recall anyone mentioning application/soap+xml, but
if we did, for the record, we meant text/xml. :-)   Nothing in SAML
protocol that I know of is defined for SOAP 1.2.

>
> Also, curl cannot know what the Content-Type should be when doing a
> post. But since the vast majority of posts made with curl are
> application/x-www-form-urlencoded it defaults to that Content-Type as
> a friendly favor if you do a post but fail to provide an explicit
> Content-Type header. So it's not really a fault of curl unless you
> believe friendly defaults are evil.

I don't disagree with its default behavior.  Just saying that it
doesn't enforce sanity on the value you send. Which it can't, as you
point out.

In the decoder, depending on the stated type as a guarantee that it's
that type and that you can parse it doesn't really work.  Even more so
if the main concern is security-related and is about the danger of
parsing "unknown" potentially malicious content.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160204/948f6691/attachment-0001.html>