Base64 image in SAML assertion

[Kevin P. Foote]

On Wed, 28 Aug 2013, MikeWho wrote:

> Am I right in thinking all attributes received in the SAML assertion (and
> mapped in the attribute map) will ultimately be sent as headers in all
> requests to the site? And thus, a Base64 encoded image in an attribute in
> the assertion would be sent in the headers of every request?

I'm sure Scott knows better .. but I think this depends on how you
protect your resource. If you are protecting "/" of the site then I
imagine it would cause every request to be bloated..

But, if you are protecting a login routine at "/your-login-code" and then
relying on the applications session then I think your request bloat
would be limited to requests for login..



------
thanks
  kevin.foote