bugProject Steve Guttenberg - Bugs: bug #3140, Configurable security model with...

 
 

bug #3140: Configurable security model with proxies with multiple addresses

Submitted by:  Gavin Brown <jodrell>
Submitted on:  Mon 07 Apr 2003 01:13:13 PM UTC  
 
Category: Security PolicySeverity: 3 - Normal
Item Group: FeatureStatus: Fixed
Privacy: PublicAssigned to: Gavin Brown <jodrell>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 07 Apr 2003 03:00:01 PM UTC, comment #1:

I have implemented a system whereby the user can specify the validation policy - it can either be 'on', 'off' or 'proxy'. 'on' is the default and is the current policy, 'off' just checks against user agent, and 'proxy' uses the HTTP_X_FORWARDED_FOR value.

Gavin Brown <jodrell>
Project AdministratorIn charge of this item.
Mon 07 Apr 2003 01:13:13 PM UTC, original submission:

Michael Fleming has sent in a patch that looks for the HTTP_X_FORWARDED_FOR variable when checking the validity of a session. While it's desirable for PSG to take into account the possibility that a user might be behind a proxy that uses a different IP for subsequent requests, it's a potential security risk. So it would be best to make it optional, with a key in $conf.

Gavin Brown <jodrell>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 07 Apr 2003 03:00:01 PM UTCjodrellStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1