secure use of ap_get_server_name/port

2008-03-06 Thread Nebergall, Christopher
I'm looking for secure versions of ap_get_server_name and ap_get_server_port which can be trusted to always evaluate to the correct host and port for re-constructing the original URL the user requested. I've removed all of the code below which seemed to rely on DNS, or info sent from the clien

Re: secure use of ap_get_server_name/port

2008-03-06 Thread Ray Morris
On 03/06/2008 01:09:37 PM, Nebergall, Christopher wrote: > I'm looking for secure versions of ap_get_server_name and > ap_get_server_port which can be trusted to always evaluate > to the correct host and port for re-constructing the original > URL the user requested. The text part of your qu

RE: secure use of ap_get_server_name/port

2008-03-06 Thread Nebergall, Christopher
Sorry let me clarify. I'm looking at doing external policy evaluation of the URI like is done is most SSO products. I have to create a policy for every URL the user may hit (with support for wildcards). I would like to minimize the number of policies created. So while there may be 5 differ

Re: secure use of ap_get_server_name/port

2008-03-06 Thread Ray Morris
On 03/06/2008 05:26:08 PM, Nebergall, Christopher wrote: So while there may be 5 different ways a user may type the hostname and port portions of the URI for the same content, I would want it to evaluate to just 1 definitive answer that I can create policy for (or at least as few as possible).