Session destruction relative to loadbalancer setting?

[Cantor, Scott]

On 1/15/13 1:08 PM, "Russell Beall" <beall at usc.edu> wrote:

>Ok, finally located the "consistentAddress" option on the Sessions
>element.
>
>Still wondering how safe this is to use, or whether I should cajole them
>into properly handling IP addresses.

It makes any cookie theft an instant session hijack. I guess it all
depends whose resources. If it were me, I'd tell the networking people to
fix it, but I'm like that.

>Anyone know of a good reliable way to map X-Forwarded-For in IIS7?

If the header is being set, it would be there, nothing's going to
overwrite it that I know of.

Are you sure the address is changing mid-session and isn't just different
from the assertion's client address initially? checkAddress is much safer
to turn off than consistentAddress.

-- Scott