disclosure of IP address in cookie

[Cantor, Scott]

On 7/5/13 11:55 AM, "David Langenberg" <davel at uchicago.edu> wrote:

>Not commenting on the value of having that cookie set or not as I don't
>maintain that plugin.  Just stating that the likely source of him having
>his IdP set that cookie is coming from the use of that plug-in.

I can't speak to the memcache plugin, but the two cookies set by the IdP
are _idp_session and _idp_authn_lc_key. The former contains the IP address
and that can't be changed.

The OP is welcome to file a RFE against the V3 project to ask that it be
encrypted, which is something we're likely to do anyway.

-- Scott