One or two sessions?

[Per Jørgen Vigdal]

I think it might be several different approaches to this, and none is 100%.
One solution could be, after login, to fetch the "Shib-Session-ID" and hash this together with the sessionID (and possibly the IP-address and the "User-Agent") and put the hash in a cookie. Then on subsequently requests compare the hash from the cookie with a hash created as after login.

/PJ

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Eirin Jenssen
Sent: 26. november 2015 11:32
To: users at shibboleth.net
Subject: One or two sessions?

How do I get Shibboleth session to stick to application's session (make them an unbreakable pair)?

If I test login with two different IDs (people) in two different browsers and copies shibstate from one session to the other, I get up the same result (data) in both browsers. (Session hicjacking)

Is this supposed to be allowed? I can not find any documentation on Shibboleth for how to handle this. Can someone please help me?

/Eirin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151127/d82dc787/attachment.html>