Adding header sanitizing option.

diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index 9458846..0cfc813 100644 (file)
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -16,7 +16,7 @@
     
     <!-- The InProcess section conrains settings affecting web server modules/filters. -->
     <InProcess logger="native.logger">
-        <ISAPI normalizeRequest="true">
+        <ISAPI normalizeRequest="true" safeHeaderNames="true">
             <!--
             Maps IIS Instance ID values to the host scheme/name/port. The name is
             required so that the proper <Host> in the request map above is found without

diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 5da0039..88befab 100644 (file)
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -200,10 +200,10 @@
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
                        <attribute name="logger" type="anyURI"/>\r
-                       <attribute name="unsetHeaderValue" type="string"/>\r
+                       <attribute name="unsetHeaderValue" type="conf:string"/>\r
                        <attribute name="checkSpoofing" type="boolean"/>\r
-            <attribute name="spoofKey" type="string"/>\r
-                   <attribute name="catchAll" type="boolean"/>\r
+                       <attribute name="spoofKey" type="conf:string"/>\r
+                       <attribute name="catchAll" type="boolean"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -226,6 +226,7 @@
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
                        <attribute name="normalizeRequest" type="boolean"/>\r
+                       <attribute name="safeHeaderNames" type="boolean"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r