The problem with IDP initiated SSO

[Cantor, Scott]

On 12/26/14, 11:10 AM, "Stefan Rasmusson" <rasmusson.stefan at gmail.com> 
wrote:

>Ok, so you can force a user to be signed in to a back account that you 
>have valid credentials for. Any idea what this attack can be used for?

If you're depositing money?

> Or is it just a general problem that you are able to make the user do 
>that?

XSRF attacks are a general class of attack. I have no special expertise in 
understanding them.

-- Scott