Revisiting the Defaulting of cookieProps, handlerSSL, etc.

[Martin B. Smith]

On 06/14/2012 12:27 PM, Nate Klingenstein wrote:
> Shib-Dev,
>
> I'm running an Installfest in Saskatoon, and one of the
> deployers(responsible for penetration testing in his day job) was
> curious as to why we still default to supporting access to handlers
> and to content hosted on HTTP.  While it's easy enough to enable
> secure cookies and SSL-only access, some deployers may be overlooking
> that and leaving themselves vulnerable to trivial session hijacking as
> a result(particularly with checkAddress and consistentAddress
> defaulting to false, though that's for arguably better reasons).
>
> Would it make sense to revisit the distribution config and/or defaults
> so that deployers who wanted to support HTTP would have to make the
> configuration changes, and not those who would like to ensure secure
> access?
>
> Thanks,
> Nate.

Hi all,

Just to add our 2 cents... I think we'd prefer it remain HTTP out of the 
box; I help troubleshoot hundreds of vanilla SP deployments here 
locally, understanding or configuration of SSL can definitely get in the 
way.

I like the idea of the warning functionality that others discussed for 
folks not using SSL; with the advent of the InCommon Certificate 
Service, the barrier to do SSL is significantly lower (for us, anyway).

Maybe it would be useful to add something to the comment in the 
distributed shibboleth2.xml to highlight the SSL issue?

Thanks,
-- 
Martin B. Smith
smithmb at ufl.edu - (352) 273-1374
CNS/Open Systems Group
University of Florida

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4893 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/dev/attachments/20120618/e13a5109/attachment.bin