Apache with mod_shib and mod_proxy

[Cantor, Scott]

> Also, I don't think I fully understand the risk of using request headers.
> I understand that these can be set by an untrusted client, but I don't know why
> it is error-prone and risky to scrub the known headers that shib sets.

Proxies should never forward "all" headers, they should start with nothing and build up a set to explicitly send. And the connection between a proxy and the back end has to be inviolate, or you're blown anyway.

The SP is not a proxy, whatever people like to think about it, so it has a different problem to deal with. Web servers don't default-deny the headers they transmit to applications, so the whole thing is imperfect and prone to bugs. There is no good reason to ever turn the SP headers on in Apache (and soon not in IIS). The SP should set server variables and the proxy module should set headers based on those variables if it wants to.

It's also crucial to have knowledge of the application APIs used and ensure that it's impossible for access to a server variable to be diverted to a header. That's a terrible practice but it used to be common.

-- Scott