Routing Problems with SLO

[Cantor, Scott]

> How could you get a new JSESSIONID on the response if this wasn't treated
> as a naive client by the servlet container?

You couldn't, but there's no way for it to appear on the URL until it makes the first return to the client and then back in, and there's also no requirement that the initial request to /Logout is part of an existing container session. I could have accessed the IdP an hour ago before that. Or a day for that matter.

> I get that the container had to generate both the JSESSIONID and the key in
> the prior response and the client is playing them back in this request, but that
> is then all after the actual problem, no?

No. There is no problem here at all that I have seen yet, certainly without any logs to demonstrate what it's doing.

>  Is it the lifetime of the HTTP session
> versus the lifetime of the other state signaling mechanisms?

If there's no container session, which is quite typical and certainly always true for the first access of a day or hour or whatever, then it will create one when a flow starts to begin tracking the execution.

-- Scott