IdP: Back Button Issue, IdPv3 Outlook

[Cantor, Scott]

On 11/23/11 9:58 AM, "Chad La Joie" <lajoie at shibboleth.net> wrote:

>Well, that's also true today.

I haven't observed a lot of variability in the types I see.

>I think the real question is whether there is a way to detect this
>particular case without creating false-positives (which is an issue we
>do have today).  If so then we can throw a specific exception that says
>"user hit back button".

Only if a cookie is added to the mix to record information. A replay is
just a replay, but a replay with a cookie indicating that the message ID
was processed might be a back button.

But at least today the first URLs you hit are a the profile handler with
no query string, and the login UI, and not a replay. Unless there's some
sort of conversational ID on the URL that could be replay checked or
matched against a "conversation completed" cookie...

-- Scott