How to support an SP that accepts both http and https on IdP

[Nate Klingenstein]

Yaowen,

Best practice is probably not to use SP's that support http because that makes cookie theft(e.g. session hijacking) pretty easy.  If this is a very low-assurance application you can make the judgment call to use it, in which case they just need to list both sets of endpoints in their metadata as valid assertion consumer service locations and send the right one in the AuthnRequest.  IP address association with a session can provide some measure of protection in this scenario.

Similarly, I would recommend that the IdP listen only over TLS.  If your metadata reflects this, then users should never be showing up at your IdP on port 80 anyway.  Whether or not to redirect users that arrive on port 80 for some reason to 443 is up to your discretion.

Hope this helps,
Nate.

On Mar 26, 2013, at 20:34 , Yaowen Tu wrote:

> Hi,
> 
> I am using Shibboleth IdP, I am wondering how to enable an SP that supports both http and https.
> 
> Should I ask for two different metadata file? Or what is the best practice in this case?
> 
> Has anybody come across a similar issue?
> 
> Apart from that a related quetion to IdP is, should IdP support both http and https, should we redirect all the http request to https for all the idp request?
> 
> Thanks,
> Yaowen
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net