Safari dropping POST variables when accessing ColdFusion9 scripts behind Shibboleth

[Cantor, Scott]

On 9/6/13 5:11 PM, "Basole, Milind M" <basole at illinois.edu> wrote:
>
>We have noticed that form variables POSTed to our CF scripts get dropped
>on their way from Safari browser via Shib SAML handlers.

If you're talking about losing them when the original POST is interrupted
by a SSO loop back to the IdP, that is:

- not specific to any one browser
- expected
- only avoidable on Apache, with some additional configuration

That's the only place any kind of handler is involved.

>This issue is not
>seen in other browsers (Chrome, Firefox and IE). PHP on the other
>hand exhibits consistent (and correct) behavior across all browsers. Thus,
>for a Shib protected directory 'foo', we have:
>http://foo/bar.cfm will have access to POST variables when posted from
>Chrome, FF and IE ­ but not from Safari.

CF is Java now, and there shouldn't be any overlap between the POST data
and the handling of request headers, which is the only thing the SP
involves itself with.

If there is an issue, I would suspect it's a bug in Cold Fusion, but I
don't see what the browser would have to do with it. I guess you'd want to
start by tracing the HTTP traffic to identify any difference in the Safari
case that might trigger a possibility.

For the record, we have CF at OSU and nobody has reported anything to me.

>We're not sure what is happening in the trip between the browser to the
>CFM scripts via SAML handlers and why is only Safari being affected, that
>too only when used in conjunction with CF9. Any thoughts, experiences or
>workarounds you can share will be most appreciated. If it matters, we're
>running ColdFusion 9 on RHEL6.4. Our Shibboleth SP is v2.5.2-1.1.el5.

I assume that's a mistype, it should end in el6, not el5.

-- Scott