Problem URL with # on login shibboleth

[Aaron Howell]

I’m not sure about the way browsers will chose to automatically URL encode sometimes - and I can’t quite tell if Teresa was asking about this type of url: https://example.com/?key=#value

If browser interpret this to automatically change the # to %23 - then there is a possibility (however I would doubt it) that it gets lost on the IdP side.



Or if Teresa actually meant: https://example.com/=#value

Then there is no misinterpreting that as anything else other than a fragment. The only way I have ever seen that work - is if there is an existing session with the SP (IdP never gets involved). If you don’t have an SP session - #it is lost for all time.



Cheers
Aaron




On 30/07/2015, 3:05 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>On 7/29/15, 11:39 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:
>>
>>> > and what's the relvant relayState setting in your shibboleth2.xml
>>> > configuration file?
>>> relayState="cookie"
>>
>>Then you'll have the URL the SP will use for the final redirect (after
>>the SAML protocol messages have been exchanged) as part of the HTTP
>>Cookie. So is there a difference in those cookies' values?
>
>And just noting, it's the server that populates the cookie's value here, so that still rests on the issue of whether the server could possibly be seeing the fragment, which I believe it cannot.
>
>-- Scott
>
>--
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.