"Replay detected of message" causes

[Cantor, Scott]

On 4/19/17, 2:19 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

> What are the possible causes for “Replay detected of message” followed by message “did not meet security requirements”?
> Could a slow client connection generate these? What if the time on the user’s device is off? Our SP and IDP time are synched. I’ve
> read that the use of the back button in some browsers could also cause these.

You should have endless streams of them in the log, I'd be much more surprised if you didn't.

> What about a browsing app on a cell phone? Can something mischievous on the user’s device like malware cause these? I’m only
> seeing these messages for remote connections – not originating on our network.

That's very unusual. I guess a decent number of back buttons will hit a later step and fail, but I would still expect plenty to hit the original request and replay it.

I would have expected most people to just add a log filter to silence them by now.

-- Scott