getPrincipals() typing

[Klingenstein, Nate]

The URL is not changed to match that of the subflow, it stays set to the original flow's path. Yes, it's weird, until you get what it's doing.

I think that actually makes precise sense now, not just the fact but also the reason.  How you get served is calculated relative to where you entered.  The client is implicitly tracking where it came in using that.

At least 4 different persistence mechanisms following at least 3 different persistence models -- HTTP requests, URLs/parameters, cookies, HTML 5 -- is where it got gross fast.  They didn't choose to use cookies or local storage, and I'm sure there are reasons, whether dumb client or efficiency.

Neither the /you/are nor the flowExecutionKey is meaningful in isolation, and from the application's POV, it's all in quasi-isolation.  These queries just show up.

This is the long story when I said "state is confusing".  I just have to think of the entire "/idp/you/are?flowExecutionKey=here" as the accessed resource and then start tracing from that point, but I can't really expect to be able to trace that down to the actual state as a human.

A user could access it, yes, and get an error, but they would never know to do it, and if they do nothing breaks, they just see an error that can be changed into whatever people want it to be.

What assumptions can I make regarding the safety of the input to Webflow?  If this is standard Webflow, "RTFM" will suffice.  I saw CDATA back in your 3.3 authentication examples, though.

There are very powerful things you can do while totally ignoring the internals, but writing flows is not one of them.

And you can't really detach the other things completely.  I wish I had joined the fight against some of the scope creep more assertively or pushed decoupled identity harder.  Much of the complexity comes from the interactions between features, and either one of those would have limited it.

This does give me great hope for identity getting decomposed into smaller services eventually, ironically.  The alternative is actually harder.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160901/2e02b670/attachment.html>