IdP cookie protection

[Chad La Joie]

The cookie isn't considered part of the public API so there isn't any
documentation of it outside the code itself.  That said, the
protections in place are:
- normal cookie domain/path settings
- user-agent address checking
- cookie content signatures using a server-side, per-session secret key
- randomly generated sessions IDs

As far as I know, that's about all you can do for cookies.

The best practice is: "don't change anything (related to the cookie)
after you install".

On Thu, Feb 23, 2012 at 09:13, Aleksandar Likic
<aleksandar.likic at securekey.com> wrote:
> Hello,
>
>
>
> We are investigating possible security risks with using shibboleth. In
> particular, the risk of stealing IdP cookies and thus gaining access to
> another user’s IdP session. I see in the docs that shibooleth IdP has some
> protection against this kind of attack, like consistentAddress property. Is
> there somewhere a complete list of features provided by shibboleth in this
> regard? What would be the best practices that one should employ during
> shibboleth deployment to protect from this?
>
>
>
> Thanks,
>
> Aleks
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered