[IdPv3] State Management and Clustering

[Etienne Dysli]

On 07/10/11 15:06, Chad La Joie wrote:
> Given these observations, it is our intent to have the *default*
> configuration of IdPv3 use cookies (or possibly HTML 5 local storage
> when available) for that information which is not related to
> back-channel operations.

Trusting any state information coming from the client is a security
issue. Signing the cookie content (as mentioned in "[IdPv3] Cookies")
could remedy that.

Still, this state data exchange increases traffic between the user's
browser and the IdP. Is this worse than increased intra-cluster traffic?
The answer is different for every deployer I guess...

Regards,
   Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 554 bytes
Desc: OpenPGP digital signature
Url : http://shibboleth.net/pipermail/dev/attachments/20111027/90f2779d/attachment.bin