Development of javascript based SAML ECP client

[Cantor, Scott]

On 3/1/15, 10:09 PM, "Nick Weedon" <nick at weedon.org.au> wrote:
>
>I have been bashing my head against a wall trying to think of a way to 
>implement ECP profile via javascript without violating the SAML spec. I 
>don't see any way to do this using cross origin hacks (e.g. JSONP, 
>iframe posting, image data hack etc) because AFAIK all of these methods 
>either involve modifying the server code (and violating the spec) or are 
>not capable of communicating the required HTTP headers.

Well, if you mean that you're implementing it in the context of a specific 
page, I can see that being impossible by design (of the web), yes. By JS, 
I kind of assumed you meant as a browser plugin.

-- Scott