disclosure of IP address in cookie

[Byte Flinger]

No plugins here other than what Shibboleth mostly provides by default.

In fact I think Scott is correct about the names of the 2 cookies I saw on
my tests.
On Jul 5, 2013 6:32 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 7/5/13 11:55 AM, "David Langenberg" <davel at uchicago.edu> wrote:
>
> >Not commenting on the value of having that cookie set or not as I don't
> >maintain that plugin.  Just stating that the likely source of him having
> >his IdP set that cookie is coming from the use of that plug-in.
>
> I can't speak to the memcache plugin, but the two cookies set by the IdP
> are _idp_session and _idp_authn_lc_key. The former contains the IP address
> and that can't be changed.
>
> The OP is welcome to file a RFE against the V3 project to ask that it be
> encrypted, which is something we're likely to do anyway.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130705/6eace0c4/attachment.html