sec-proxy should remove incoming sec-* headers

[fvanderbiest]

Based on a fresh georchestra install on http://sdi.georchestra.org, I am witnessing a strange behavior:

• in Chromium, the header shows the correct user id and it is up to date with my current logged-in status.
• in FF, after logging out, the header still shows my user id (but I know I am not logged in anymore, since the geoserver home page does not show the admin page)

[fvanderbiest]

Note that the static webapp goes through the security-proxy now.

[fvanderbiest]

works fine on IE9

[fvanderbiest]

works fine on FF 21 / linux at home. I have to check which FF version I'm running at work.

[fvanderbiest]

Got it: my FF at work (version 21 too) has the "modify headers" extension ON by default

[fvanderbiest]

This is critical, since one can access http://sdi.georchestra.org/mapfishapp/edit (normally reserved to members of SV_ADMIN, SV_REVIEWER or SV_EDITOR groups) by setting the appropriate headers.

The proxy should remove the incoming sec-* headers.

[fvanderbiest]

In the mean time, all geOrchestra instances are advised to add those lines in their apache config:

    RequestHeader unset sec-username
    RequestHeader unset sec-roles

[severo]

see #149 on a related topic

[jesseeichar]

I am a little late to this party but this breaks extractor app as mentioned in @fvanderbiest 's comment on #633. If you look in the proxy-servlet.xml file there is a filter that is supposed to do this filtering as long as the request does not come from a "trusted" server. A trusted server can provide the headers.

[jesseeichar]

I am making a new pull request that reverts this change but adds tests that demonstrate that the headers are removed by default. This should fix #633

[fvanderbiest]

OK, I am relieved about that. Thanks.

[fvanderbiest]

People should also make sure to remove the

RequestHeader unset sec-*

apache directives if they had been set.

[fphg]

Hi
I won't drop the header unset rules for now because I'm not confident about the IP src check. I think that incoming traffic has to be sanitized on the reverse proxy.

[fvanderbiest]

Closed with #648

[fvanderbiest]

Note: contrary to what I said in the above comment,

RequestHeader unset sec-username
RequestHeader unset sec-roles

directives can still be used.

[fvanderbiest]

(though they should be useless if one trusts the proxy for doing its job)