"Replay detected of message" causes

[Ullfig, Roberto Alfredo]

We don't see an steady stream of these. Only 310 Replays yesterday. I just need to know what to tell the end user when he/she sees the message "did not meet security requirements". Should "restart your browser" or "don't use the back button" suffice?

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Architecture and Development | ACCC
University of Illinois - Chicago


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, April 19, 2017 1:57 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: "Replay detected of message" causes

On 4/19/17, 2:19 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

> What are the possible causes for “Replay detected of message” followed by message “did not meet security requirements”?
> Could a slow client connection generate these? What if the time on the 
> user’s device is off? Our SP and IDP time are synched. I’ve read that the use of the back button in some browsers could also cause these.

You should have endless streams of them in the log, I'd be much more surprised if you didn't.

> What about a browsing app on a cell phone? Can something mischievous 
> on the user’s device like malware cause these? I’m only seeing these messages for remote connections – not originating on our network.

That's very unusual. I guess a decent number of back buttons will hit a later step and fail, but I would still expect plenty to hit the original request and replay it.

I would have expected most people to just add a log filter to silence them by now.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net