HTTP-only ACS URL

[Cantor, Scott E.]

On 8/2/11 3:45 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>My understanding of this is that it is dependent on browser. Some browsers
>will pop up that warning on the POST of data from the SSL site to the HTTP
>site and some don't. To add to that, some allow you to turn off the
>warning via preferences. To my knowledge there is not a way for the IdP
>site to control that behavior.

No, there isn't.

>I suppose, though have never tried, that if you used artifact binding, you
>might get around it. The redirect would be a simple GET and I don't think
>would trigger the warning.

AFAIK, that's the only work-around.

BTW, the purpose of the SSL is not to protect the data. It's to protect
the session with the SP, as I would hope Firesheep finally proved. The SSL
is not between the IdP and SP on the front channel, so it doesn't qualify
as a substitute for data encryption.

-- Scott