Question for high volume sites

[Cantor, Scott]

On 8/24/11 3:27 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>This rings a bell for some reason - where the browser would abort and
>try again for some reason.  I can't remember any details though...

It's possible that I'm getting similar behavior from clients, but it's
hard to tell since the back button, etc. produces the same replay outcome.

In this case, I have the back channel doing this replay internally, and
based on libcurl history, it appears not to do that unless it gets no
TCP-layer ACK back indicating that the data it sent was received. So I
think our network/load balancer is getting in the way somehow and not
properly dealing with closed HTTP sockets. The IdP server gets the
request, the SP doesn't know it and resends it over a new connection, and
the IdP sees the second as a replay.

For the moment, I turned off replay checking on SOAP calls, and turned off
message signing there since I'm not comfortable with that without replay
checking.

-- Scott