Shib SP: how to prevent the user from initiating logout by entering URL in address bar?

[Cantor, Scott]

On 6/11/14, 12:37 PM, "Andrew Webb" <andrew.webb at statpro.com> wrote:

>A user can enter
>https://mywebsite.domain.com/Shibboleth.sso/Logout?return=https%3a%2f%2Fww
>w.google.com%2f
>in the address bar (or click on a link with this URL) to initiate a logout
>from an SP.
>
>How to prevent this?
>
>Can (for example) the Shibboleth.sso/Logout endpoint be made to support
>POST
>only, and not GET?

That certainly wouldn't prevent anything. As Kevin said, if you want to
disable the handler, just comment out <Logout>.

-- Scott