Add optional ASSERTION_URL setting #23
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We pass the result of `get_current_domain` to pysaml2 to validate the source of the incoming StatusResponse (the scheme+host of the request). This is not viable in a reverse proxy scenario, in particular when the host, port, and/or scheme of the django server changes with churn. As a solution, alter `get_current_domain` to just use a setting variable, `ASSERTION_URL`, instead of the scheme and host of the incoming SAML request. If the setting is not present, use the current behavior.
|
it would be great if you can fix the README and AUTHORS accordingly (since I'm not a native English speaker). 😄 |
|
Good call. Done. |
|
Good to go. will release a new pip version soon. |
|
Hi @tonymke I have it released as 2.1.1 on pypi. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We pass the result of
get_current_domainto pysaml2 to validatethe source of the incoming StatusResponse (the scheme+host of the
request).
This is not viable in a reverse proxy scenario, in particular when the
host, port, and/or scheme of the django server changes with churn.
As a solution, alter
get_current_domainto just use a settingvariable,
ASSERTION_URL, instead of the scheme and host of theincoming SAML request. If the setting is not present, use the
current behavior.