disclosure of IP address in cookie

[David Langenberg]

Are you perhaps using the Memcache IdP storage plugin?  That plugin sets
the _idp_authn_lc_key cookie.

https://wiki.shibboleth.net/confluence/display/SHIB2/Memcached+StorageService

Note, that plugin is not part of the shibboleth product nor supported by
the shibboleth project.  See the wiki page for the contact info for that
particular module maintainer.

Dave


On Fri, Jul 5, 2013 at 9:33 AM, Byte Flinger <byteflinger at gmail.com> wrote:

>
> On Jul 5, 2013 12:16 PM, "Peter Schober" <peter.schober at univie.ac.at>
> wrote:
>
> > I can't find the string "_idp_lc_session" (or "_idp_lc_") in the IdP's
> > source code, so unless I'm looking at the wrong code (very well
> > possible) an unmodified IdP does not set a cookie with that name.
>
> Actually Shibboleth sets the same cookie for me too and I happen to
> discover today that it is a base64 and URL encoded string which is based,
> among other things, on the ip address.
>
> I did not do anything to set this cookie and while I am not using the
> default configuration of Shibboleth I suspect that this comes by default.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130705/ae7f0a94/attachment.html