sending environment variables to weblogic

[Richard Frovarp]

On Wed, 2021-03-31 at 20:15 +0200, Peter Schober wrote:
> * Richard Frovarp via users <users at shibboleth.net> [2021-03-31
> 01:25]:
> > And to clarify, AJP is as secure as HTTP proxying, which is to say
> > not
> > secure. Keeping it all on localhost means you can ignore the on the
> > wire encryption that you would get from HTTPS.
> 
> Sure, I was assuming localhost in all cases. But they're not the same
> even then, e.g. you can't transport REMOTE_USER over HTTP Requests
> Header (e.g. in order to satisfy request.getRemoteUser()) -- with
> HTTP
> proxying you can merely make up an arbitrary HTTP Request Header and
> use httpd tricks (for httpd 2.2 you'd have to use rewrite) or mod
> headers (since 2.4= to set that header based on REMOTE_USER's value.
> 
> AJP is also supposed to be more efficient since it avoids multiple
> HTTP decoding and re-encoding steps. It's also less frickle wrt what
> character are allowed in header names, their casing, etc.
> 
> -peter

Note that the AJP connector is deprecated in Tomact 10, and will be
removed in Tomcat 10.1.x onwards.

https://tomcat.apache.org/tomcat-10.0-doc/config/ajp.html

Migration talk about getting off of AJP from ApacheCon last year:

Migrating from AJP to HTTP: It's About Time
https://youtu.be/qUjUEvGFstI

So that project is moving off of AJP, as it doesn't provide any
functionality above and beyond HTTP. It provides some quicker setup for
sending values, but mod_proxy_http has the ability to send all of the
values that AJP has.

The Jetty project is actively discouraging people from use AJP.

So it is a thing that is going away.