disclosure of IP address in cookie

[Byte Flinger]

On Jul 5, 2013 12:16 PM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

> I can't find the string "_idp_lc_session" (or "_idp_lc_") in the IdP's
> source code, so unless I'm looking at the wrong code (very well
> possible) an unmodified IdP does not set a cookie with that name.

Actually Shibboleth sets the same cookie for me too and I happen to
discover today that it is a base64 and URL encoded string which is based,
among other things, on the ip address.

I did not do anything to set this cookie and while I am not using the
default configuration of Shibboleth I suspect that this comes by default.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130705/f97fd034/attachment.html