requireSession and Limit with Apache 2.2.x

[Scott Koranda]

Hi,

Using this configuration

<Directory /path/to/some/cgi/scripts>
    AuthType shibboleth
    Require shibboleth
    <Limit POST>
        AuthType shibboleth
        ShibRequestSetting requireSession 1
        Require valid-user
    </Limit>
</Directory>

I would have expected that any POST to my CGI script would
have immediately triggered a session initiation, but that a
GET to the same script would only have triggered the
initiation of the module and hence the ability to support a
lazy session approach.

I find, however, that a GET immediately triggers session
initiation.

What am I doing wrong?

I am using Apache 2.2.16 and Shibboleth SP 2.4.3.

Thanks,

Scott K