Safari 5.1.5, Shibboleth, and an interesting Reverse Proxy setup

[Cantor, Scott]

> What appears to be occurring with the new Safari - is that there are 2 form
> POSTs that occur automatically (using javascript) from the IdP in the whole
> process of gaining access to the Intranet (one to the Reverse Proxy and one
> to the Staff Intranet) - the latest version of Safari is submitting the contents
> of the first POST both times - instead of the expected behaviour of
> submitting the contents of the second form on the second POST. You can see
> this definitely occurring when you trace the traffic.

I reported that something was being observed by people running gateway-based SAML deployments a couple of weeks ago (though I didn't mention the gateway part, that hadn't been established as the trigger).

The thing that has to be verified is that the IdP is expiring the page that returns the form containing the javascript in each case. If it expires the form, then the browser is clearly at fault, and there's a very serious bug. If it doesn't expire the form, this is Safari being Safari, and it isn't the first time I've seen it do things like this.

-- Scott