Possible to disable the invoking of Login/Logout handlers via browser address bar?

[Andrew Webb]

Our website lazily initiates SSO session by redirecting to
/Shibboleth.sso/Login?entityId=X&forceAuthn=true|false.

Similarly it terminates session by redirecting to
/Shibboleth.sso/Logout?return=Y.

When logging in, we use one of a number of different runtime criteria for
determining the entity id of the IdP to use (e.g. hostname alias used to
access our website), and for determining the value of forceAuthn.

So... it's not ideal that the user can enter whatever they want for session
initiation by manually editing the URL in the address bar and hitting Enter. 
Similarly it's not ideal (but not a train smash) that the user can terminate
session at any time (with their own return address) via the address bar.

Is there a way to prevent handler invocation via manual address bar
manipulation?




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Possible-to-disable-the-invoking-of-Login-Logout-handlers-via-browser-address-bar-tp7581455.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120824/be271be0/attachment.html