"Replay detected of message" causes

[Cantor, Scott]

> We don't see an steady stream of these. Only 310 Replays yesterday. I just
> need to know what to tell the end user when he/she sees the message "did
> not meet security requirements". Should "restart your browser" or "don't
> use the back button" suffice?

Well, to be fair, that's one specific condition, and no, that's not a silly number, I checked my log and it's not out of line with that. The much more common ones are flow exceptions and message decoder failures.

If the user hits the back button, it will of course fail. I have numerous error conditions mapped to a message [1] that handles all the different common cases, including bookmarks and such. Among the conditions that are involved are things that would default-map to that message out of the box.

(Restarting a browser does nothing, so that's really never relevant advice.)

A replay would not typically be due to back button, but if you had the right sequence of steps and the back button was used quickly enough and probably a couple of times, sure. Which fits the "rare" argument. A bookmark would normally be a bit more common, but anecdotally I think bookmarks are typically not a thing anymore, not as much at least.

-- Scott

[1] https://webauth.service.ohio-state.edu/idp/profile/SAML2/Redirect/SSO