UID not available in HTTP variables

[Cantor, Scott]

On 6/20/19, 8:47 AM, "users on behalf of John Schrader" <users-bounces at shibboleth.net on behalf of John.Schrader at nd.edu> wrote:

> If I understand things correctly re the useHeaders option; it should be used in conjunction with safeHeaderNames=true
> and you should only use the headers prefixed with "HTTP_"

It's much more involved and open to unknowns than that. There is no safe way to use headers and no reason to do so anymore unless HTTP proxying is involved (which I would never do by choice anyway). Cold Fusion should be able to read CGI variables, and Tomcat can read them from there too via the AJP_ prefix trick, so in the end it's a matter of doing the necessary work.

-- Scott