Relying Party

[Stein, Eric]

Scott, Peter,
  Thanks, I was able to get it going by changing httpd to only listen on port 443, not 80.

Eric Stein

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Thursday, April 04, 2013 9:31 AM
To: users at shibboleth.net
Subject: Re: Relying Party

* Stein, Eric <steine at locustec.com> [2013-04-04 15:10]:
> Thanks, Scott. I'm taking a look at my options. Is it adequate to have 
> my firewall reject requests to port 80, or should I leave it open and 
> have httpd force redirects on 80 to 443?

If you can get away with allowing only 443 that's much safer (see Moxie's presentation on sslstrip for details.) Most sites won't, though, as people don't type the scheme part of URLs anymore (and/or expect a search engine to correct their URLs).
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net