issue with IIS application integration

[Cantor, Scott]

> If an application does invoke the sessionInitiator directly, I presume that app
> response needs to be a protected location in order for the handler to provide
> session / attribute information back to the application?

The filter, but yes, generally that's correct. There are some obscure ways one might try and hack around that requirement with newer versions but it's pretty hard to do that securely without some tentacle of the app being exposed to the filter intercepting and decorating the request at least once.

I've seen people try and implement things with redirection, literally not understanding you can't just pass a bunch of parameters on a URL to yourself and expect it to be secure. Basically, when people don't "get it", you tend to see a lot of really weird and dangerous tangents that you have to watch out for. It's fair to say that people manually redirecting to the initiator tends to be corrolated to people doing dumb things, it's just not fair to assume it's always dumb.

-- Scott