Server variable value duplicated when IIS Default Document module invoked?

[Cantor, Scott]

On 7/26/21, 4:01 PM, "Wight, Jared" <WightJW at umkc.edu> wrote:

>    Thanks! I've submitted a bug report. I kept defaults for most everything, feel free to modify as needed.

I just made it a RFE, it's not a bug. The bug is in that other module you're talking about, and it's a vulnerabiliy, not just a bug. Somebody really ought to report that. It's a lucky break that we fixed this original bug in our code and it caught theirs.

If a module were pushing a secret into a variable for use by application code during a request and then it showed up in a subsequent request that wasn't even for the same resource as the original....

It's a pretty huge violation of the contract involved when you do this stuff and I certainly have caused my share of those.

-- Scott