The problem with IDP initiated SSO

[Christopher Bongaarts]

On 12/23/2014 12:03 PM, Cantor, Scott wrote:
> On 12/23/14, 5:53 PM, "Christopher Bongaarts"<cab at umn.edu>  wrote:
>> >The idea behind XSRF is that a malicious site can essentially make the
>> >user send an authenticated request to a target site with data controlled
>> >by the attacker.  Tying cookies to URLs doesn't matter, as the attacker
>> >doesn't ever use them directly; everything about the forged request is
>> >legitimate except the contents of the request itself.
> The body specifically. If you can control the whole request, then cookies
> do nothing here, since the attacker can supply any cookies required to
> authorize the response to the SP. Controlling the entire HTTP request
> amounts to a full MITM attack.

I was thinking GET parameters as well as POST, but you're right about 
controlling arbitrary headers...

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%