security of "shibuseheaders"

[Liam Hoekenga]

We have a developer working in .NET Core on Linux.  There is no SAML
implementation for .NET Core, so they're looking at putting their
application behind Apache HTTPd. .NET Core apparently also can't get
information from the web server environment, so they'd like to pull it from
headers.

The Apache SP docs strongly recommend against enabling ShibUseHeaders.  The
wiki page on spoof checking says:

    Under no circumstances should you rely on the request header
    option other than as a temporary measure while adjusting applications
    to use the environment option.

The same entry says that the only way to really get attribute information
into IIS is via headers:

    The ISAPI filter API does not appear to support the creation
    of environment variables, so request headers are used out of
    necessity as a portable communication channel to applications.

But the IIS SP config page does not include warnings about the insecurity
of passing attribute information via headers.

If headers + spoof checking is as insecure as the spoof checking article
suggests, should we not use the IIS module for sensitive applications?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161123/fbd5af36/attachment.html>