SP Address Checking From Web Server as Source

[Cantor, Scott]

I don't know that one would want the SP "protecting" such requests, you wouldn't want to be messing with trying to get the client's cookies to be sent with such loopback requests. Not requiring a session isn't far enough, you want it excluded entirely and rely on IP rules for access I'd expect.

> I’m also wondering if I even understand the purpose of the
> unreliableNetworks attribute, as that seems to not be
> relevant to requests coming from the web server itself. 

It isn't. A single range would have to encompass both the client network(s) and localhost, which is I would think impossible other than by making all network ranges unreliable, equivalent to disabling it.

I have no intention of adding more code now to handle localhost differently, but you can file a RFE against the replacement project [1] so we can implement a different setting there, though that's a long time off.

But I don't think I'd tend to see it as a great design in general to do that, server to server is very different in nature from client to server, that's not a difference I would want to hide were it me.

-- Scott

[1] CPPSP is the Jira project key for the new agents,"Shibboleth SP - Native Agents and Library - C++"