Sending a user bac to the discovery service from my IDP login page

[Wessel, Keith]

I think this is a good enough case for just having the clear rememgered choice page tel the user to start over, and our usability person agrees... especially compared to the alternative of tell the user to manually delete cookies from the browser.

Thanks, Scott and others.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, March 11, 2016 4:01 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Sending a user bac to the discovery service from my IDP login page

> One final question: is there any way, given an entityID, to obtain hat entity's
> default discovery response endpoint from the IDP's loaded metadata?

One way or another, yes, but when you have an SP with vhosts, you wouldn't know which endpoint to actually use...

> But at least you have confirmed for me that using the referer route is a very
> bad idea from a security standpoint.

I don't think it really matters all that much for security, but it's just not consistently there or accurate. Same problem occurs with trying to fix the back button. You may be thinking you can get the Referer accurately, but the webflow engine will overwrite it because it does weird extra steps when you display a view, and you lost the original value.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net