Shib SP: how to prevent the user from initiating logout by entering URL in address bar?

[Andrew Webb]

Ok, I got it.

Logouts (and logins for that matter) are initiated via GETs.


/>> What's the problem you're trying to solve?/

My understanding of HTTP is that GETs shouldn't cause state changes on the
server.  They are just for reads.  So in the browser context, only a POST
should cause a server state change.


/>>Why would you want to prevent me fro ending the Shib SP's session on your
webserver?/

I want you to click on our Logout button which will POST to the server (with
anti-CSRF measures), and then the server will peform the logout.


/>>And does the SAML IDP (or do all SAML IDPs usable with your SP) actually
support SLO?/

Some do; some don't.  Our own IdP does not, in accordance with the sensible
views stated here:-
https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shib-SP-how-to-prevent-the-user-from-initiating-logout-by-entering-URL-in-address-bar-tp7601911p7601975.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.