HTTP-only ACS URL

[Cantor, Scott E.]

On 8/2/11 7:48 PM, "Russell Beall" <beall at usc.edu> wrote:

>Thanks for the answers Scott.
>
>Is reduced security one of these costs, or just the complexity of
>maintaining Artifact support?

There are some different threats but I don't think on balance they're any
worse. I guess the fact that artifacts show up on URLs in logs can create
some attacks that aren't likely otherwise.

There are more detailed papers done on artifact actually.

-- Scott