Development of javascript based SAML ECP client

[Nick Weedon]

Yeah sorry, I was a bit vague there. I did indeed mean Javascript in the 
context of a web page.

With regard to it being impossible by design, I thought as much but its 
good to get some feedback anyhow, much appreciated.

Nevertheless, the ability to circumvent this limitation via hacks still 
makes my small project worthwhile, at least for me :)

Thanks,
Nick

On 3/03/2015 12:49 AM, Cantor, Scott wrote:
> On 3/1/15, 10:09 PM, "Nick Weedon" <nick at weedon.org.au> wrote:
>> I have been bashing my head against a wall trying to think of a way to
>> implement ECP profile via javascript without violating the SAML spec. I
>> don't see any way to do this using cross origin hacks (e.g. JSONP,
>> iframe posting, image data hack etc) because AFAIK all of these methods
>> either involve modifying the server code (and violating the spec) or are
>> not capable of communicating the required HTTP headers.
> Well, if you mean that you're implementing it in the context of a specific
> page, I can see that being impossible by design (of the web), yes. By JS,
> I kind of assumed you meant as a browser plugin.
>
> -- Scott
>