Programmatic Access to SP Attributes

[Cantor, Scott]

> In .NET your attributes will be available as Server Variables:
> 	Request.ServerVariables.GetValues("HTTP_BLAH");
> 
> Attributes will *not* be available in the Request Headers:
> 	//bad
> 	Request.Headers.GetValues("HTTP_BLAH");	// won't exist
> 	//bad
> 	//you will find
> 	Request.Headers.GetValues("BLAH");	//don't use this!  It's coming
> from the user's browser and shouldn't be trusted!
> 	//bad

I don't know what distinctions you're trying to draw but:

a) The only way the ISAPI module (NOT the beta of the IIS7 module) makes the data available is in request headers, and

b) they are not from the browser, they have to be sanitized and protected by the SP by clearing them and detecting attempts to spoof them, which the module does.

They are in headers. Period. The native module changes that, allowing for either case.

What the APIs do and what they seem to be called is immaterial, it's a mess of conflicting names and weird problems that is covered at some length in the wiki since some of them are inherently risky.

-- Scott