Avoiding empty headers for undefined attributes

[Cantor, Scott]

> OK, let's try a better formulation: as the SP and the application don't live on the
> same hosts, the only way to pass user attributes between hosts relies on HTTP
> headers. Those headers can be set either from the SP itself, or from the web
> server living on the same host as the SP. Am I correct ?

Yes, and they should always be set by the web server.

> Oops, inconsistent vocbulary of mine: I meant a test *application*, seen as a
> service provider from the outside world.

I figured, but that's why I spoke to both cases just in case.

> f I understand correctly, what you're suggesting is to conditionally set those
> headers from the web server (apache), using a set of configuration directives
> such as:

Yes, that's the correct way to proxy headers (in any situation, independent of this specific one). You never proxy all headers as a pass-through, that's insecure on a number of different levels and leads to all sorts of security holes on the back-end.

-- Scott