Shib SP: how to prevent the user from initiating logout by entering URL in address bar?

[Peter Schober]

* Andrew Webb <andrew.webb at statpro.com> [2014-06-12 10:31]:
> And if comment out <Logout>, how would my website programmatically perform a
> Shib logout?  I want to do logout, but I don't want the user being able to
> do so via the address bar or a link, using GET.

Not possible. You'll notice that you don't "programmatically" perform
a logout other than causing the creation of a 'Location' HTTP response
header to the HTTP User Agent, in turn causing it to make the exact
same HTTP GET request to the SP's Logout handler you say you don't
want them to be able to make.

What's the problem you're trying to solve? Why would you want to
prevent me fro ending the Shib SP's session on your webserver?  I
could just as well delete the Shib SP's session cookie for your
webserver form my user agent.
And does the SAML IDP (or do all SAML IDPs usable with your SP)
actually support SLO?  And do all /other/ SPs the subject may have
accessed?  Otherwise what will any kind of logout achive, other than
creating a false sense of being "secure" for the subject, arguably
even lowering security for the subject and her data.
-peter