The problem with IDP initiated SSO

[Cantor, Scott]

On 12/23/14, 5:53 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>The idea behind XSRF is that a malicious site can essentially make the 
>user send an authenticated request to a target site with data controlled 
>by the attacker.  Tying cookies to URLs doesn't matter, as the attacker 
>doesn't ever use them directly; everything about the forged request is 
>legitimate except the contents of the request itself.

The body specifically. If you can control the whole request, then cookies 
do nothing here, since the attacker can supply any cookies required to 
authorize the response to the SP. Controlling the entire HTTP request 
amounts to a full MITM attack.

As you noted, TLS end to end is the real fix, but that's undeployable in 
practice. The client could also be modified to support channel binding, 
but that ain't happening either.

-- Scott