Shib SP: how to prevent the user from initiating logout by entering URL in address bar?

[Kevin Foote]

On Jun 11, 2014, at 9:37 AM, Andrew Webb <andrew.webb at statpro.com> wrote:

> A user can enter
> https://mywebsite.domain.com/Shibboleth.sso/Logout?return=https%3a%2f%2Fwww.google.com%2f
> in the address bar (or click on a link with this URL) to initiate a logout
> from an SP.
> 
> How to prevent this?
> 
> Can (for example) the Shibboleth.sso/Logout endpoint be made to support POST
> only, and not GET?

I don’t know about that .. but you can remove the <Logout> section from your shibboleth2.xml file to make it not work. 
Or probably use a Redirect Rule to stop the request from initiating the Logout 

--------
thanks
 kevin.foote