Sending a user bac to the discovery service from my IDP login page

[Cantor, Scott]

> One final question: is there any way, given an entityID, to obtain hat entity's
> default discovery response endpoint from the IDP's loaded metadata?

One way or another, yes, but when you have an SP with vhosts, you wouldn't know which endpoint to actually use...

> But at least you have confirmed for me that using the referer route is a very
> bad idea from a security standpoint.

I don't think it really matters all that much for security, but it's just not consistently there or accurate. Same problem occurs with trying to fix the back button. You may be thinking you can get the Referer accurately, but the webflow engine will overwrite it because it does weird extra steps when you display a view, and you lost the original value.

-- Scott