AJAX call and shibstate cookie accumulation.

[Koorosh Vakhshoori]

Recently we deployed a web application where it makes multiple AJAX
callbacks. All the web pages as well as the AJAX services are behind a
Shibboleth SP. We noticed when a user's Shibboleth session expires the
browser keeps accumulating _shibstate_xxx cookies until he/she gets
the following HTTP error:

HTTP return status code 400:

Bad Request
Your browser sent a request that this server could not understand.
Size of a request header field exceeds server limit.

After some investigation, we discovered the problem had to do with our
client side JavaScript ignoring the HTTP 302 redirect request from SP.
This resulted in accumulation of _shibstate_xxx cookies where at some
point it would result in exceeding the maximum HTTP header field size.

Now our solution is to first catch the session time out in JavaScript
and delete all _shibstate_xxx cookies by setting their expiration date
into past and redirect user to the login page. Any comments or
suggestions?


Thanks,

Koorosh