Strange Firefox/Shibboleth interaction with Cache-Control and shib session

[Micky Williamson]

Scott,
the side affect is that Shibboleth doesn’t have a valid session, checked with www.app.com/Shibboleth.sso/Session but, when the app is access, the user is not prompted to log in.  I would think that without a valid session, shibboleth would force a redirect to the iDP….do I have that wrong?

Micky
> On Jul 11, 2016, at 3:42 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> On 7/11/16, 5:28 PM, "users on behalf of Micky Williamson" <users-bounces at shibboleth.net on behalf of mwilliamson at silasg.com> wrote:
>
>> I’m seeing a strange integration between Firefox caching, and Shibboleth.
>
> This is how browsers work. Session restore is not a server issue, that's up to the client.
>
>> The desired behavior is to have the user login to the app each time they open the browser.
>
> You cannot achieve that.
>
>> This seems to work for Chrome,
>
> That depends on the settings. Firefox just happens to use different defaults.
>
> This is not about caching headers, it's about cookies and how browsers work today.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.