sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Scott Cantor]

> Except...the IdP now does this already, as we primarily use session cookies. I'll double check, but I'm pretty sure we're setting it to -1 internally there also, this is actually the same code of course.

We are. There's a property in the IdP that can cause the IdP session cookie to have a max-age, but the default wiring injects -1 into the same code the SP is using, and as far as I know that certainly works on Tomcat and you get a session cookie out.

So...yeah, pretty weird.

Having said that, I think we still are considering the possibility of switching the SP's cookies to default to persistent because paradoxically, you get permanent cookies now when you want session cookies, whereas with persistent cookies you can set max-age to 300 or something and they go away properly.

Ridiculous, but that's the web.

Still would love to understand how max-age is getting screwed up like this.

-- Scott