Programmatic Access to SP Attributes

[Cantor, Scott]

> The wiki explains the ideas quite clearly, but the .NET code sample at the
> bottom of the page is setup to send a programmer who is looking to read
> *attributes* in either of the wrong directions before they get to the working
> answer.

Not having touched .NET I wouldn't know, but I'm simply saying that all the data are in request headers currently, and I can't really imagine that requesting the data in that way wouldn't "work". There may be other ways.

The only actual example is Request.Headers("Shib-Identity-Provider") and that was used because it is much, much safer than using the ServerVariable approach. As in, when the bug existed, one was exploitable and the other wasn't. Both should be safe now, but one appears to be much more resilient than the other.

-- Scott