Hello CAS developers,
I have a couple of questions about logout requests behind a load balancer.
1) In Client.php
public function handleLogoutRequests($check_client=true,
$allowed_clients=array())
{
phpCAS::traceBegin();
if (!$this->_isLogoutRequest()) {
phpCAS::trace("Not a logout request");
phpCAS::traceEnd();
return;
}
I'm calling phpCAS::logoutWithRedirectService($logout_url);
but the function above never gets past the line
if (!$this->_isLogoutRequest()) {
even though I would have though that logoutWithRedirectService() is a
logout request? However, my app still does appear to logout from CAS (I
can see the log request go out to our CAS server), but I was just wondering
if/why my request isn't a _isLogoutRequest(). Or is it ok that the rest of
the code in that function is never run?
2) Also in Client.php
in the same function above, further down in the code, there's a line
$client_ip = $_SERVER['REMOTE_ADDR'];
If my app (ever gets to that line (see #1 above)) is behind a load
balancer, wouldn't that line NOT be reliable? should it also be checking for
HTTP_CLIENT_IP
HTTP_X_FORWARDED_FOR
HTTP_X_FORWARDED
HTTP_X_FORWARDED
HTTP_FORWARDED_FOR
HTTP_FORWARDED
REMOTE_ADDR
https://stackoverflow.com/questions/44085102/php-most-accurate-safe-way-to-get-real-user-ip-address-in-2017
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAKL84%3D%3DJ%3DuoZ_vWwV6UjCiwc3eJU5euLd%3D1QtuBa%3DT_QtD_1_A%40mail.gmail.com.
