User induced session stomping?

[Kevin P. Foote]

I'm seeing no login context back button yes.. these are caught by my Servlet and
logged differently than the other errors that OP started this thread
with.. 

So I'm seeing 'No login context' found via back-button resulting in messages 
coming from HttpServletHelper, this is something I trap for at jsp, as well as 
no login context coming from the AuthenticationEngine. 

The latter are the ones I was relating to the self inflicted session stomping.

------
thanks
  kevin.foote

On Mon, 27 Aug 2012, Cantor, Scott wrote:

-> On 8/27/12 11:58 AM, "Chad La Joie" <lajoie at itumi.biz> wrote:
-> 
-> >In theory, I think so.  I don't believe the IdP does do that, however.
-> > In the case you noted you'll have one login context with a completed
-> >authentication recorded.  In the case of the OP, you end up with
-> >multiple login contexts none of which has completed.
-> 
-> Yeah, I didn't think the IdP today did, just wondering if it was possible
-> with the brute force error message testing I do. Mostly I wondered how
-> Kevin knew that *that* was that cause of the error his users saw.
-> 
-> -- Scott
-> 
-> --
-> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
->