sending environment variables to weblogic

[Peter Schober]

* Richard Frovarp via users <users at shibboleth.net> [2021-03-31 01:25]:
> And to clarify, AJP is as secure as HTTP proxying, which is to say not
> secure. Keeping it all on localhost means you can ignore the on the
> wire encryption that you would get from HTTPS.

Sure, I was assuming localhost in all cases. But they're not the same
even then, e.g. you can't transport REMOTE_USER over HTTP Requests
Header (e.g. in order to satisfy request.getRemoteUser()) -- with HTTP
proxying you can merely make up an arbitrary HTTP Request Header and
use httpd tricks (for httpd 2.2 you'd have to use rewrite) or mod
headers (since 2.4= to set that header based on REMOTE_USER's value.

AJP is also supposed to be more efficient since it avoids multiple
HTTP decoding and re-encoding steps. It's also less frickle wrt what
character are allowed in header names, their casing, etc.

-peter