IdP: Back Button Issue, IdPv3 Outlook

[Chad La Joie]

On 11/23/11 10:03 AM, Cantor, Scott wrote:
> On 11/23/11 9:58 AM, "Chad La Joie" <lajoie at shibboleth.net> wrote:
> 
>> Well, that's also true today.
> 
> I haven't observed a lot of variability in the types I see.

Right, because today there isn't way to tell the difference between bad
message and replayed message caused by the back button vs other bad
client/load balancer/SP behavior.  But there are about a dozen different
errors you can conceivably receive during message processing, and in v3
many of those are being broken down further.

>> I think the real question is whether there is a way to detect this
>> particular case without creating false-positives (which is an issue we
>> do have today).  If so then we can throw a specific exception that says
>> "user hit back button".
> 
> Only if a cookie is added to the mix to record information. A replay is
> just a replay, but a replay with a cookie indicating that the message ID
> was processed might be a back button.
> 
> But at least today the first URLs you hit are a the profile handler with
> no query string, and the login UI, and not a replay. Unless there's some
> sort of conversational ID on the URL that could be replay checked or
> matched against a "conversation completed" cookie...

Right, like I said, I don't think we yet have a sure way to detect this.
 Webflow does have a conversation ID, and that *might* allow us to
detect this, I'm not sure yet.