RFC3 - Define Acceptable Service Urls
- ScottS
Owned by ScottS
Currently, CAS accepts any arbitrary service urls, unless restricted by the Services Management Tool (which its recommend you use). This may not be ideal, often does not make it clear what services are being accessed, and makes debugging harder.
The following prefixes are recommended:
https:// (or http://) - HTTP based services, including RESTful and SOAP based services offered over HTTP
imap:// (or imaps://) - IMAP services that are generally used for proxying
smtp:// (or smtp://) for SMTP services
We may wish to rely on the list here
CAS would parse and understand these prefixes only. This would provide a minimal level of security and protection even if the Services Management Tool was not used.