Question on ShibbolethSP 2.5.3 | AddressChecking | consistentAddress

[Cantor, Scott]

> 1)  Is this client's network behavior in this case becoming more common place
> these days in computer networks and is it a growing trend, making the
> consistentAddress check obsolete or would use say it is not normal (maybe
> going as far saying it is unorthodox and a bad practice) and not the case
> where the consistentAddress check is non longer relevant.

If this was really that common, I think we'd get more questions about it. checkAddress is pretty well unusable outside the enterprise, and isn't such a big deal to start with, but consistentAddress just seems like common sense to me.

> 2) How important on a scale of 1 to 10 of increasing importance, would you
> say having the consistentAddress check enabled would rank in the security of
> the shibboleth-sp.

About an 8 for me.

> 3) What security risks, concerns and vulnerabilities would exist by having the
> consistentAddress check disabled in shibboleth-sp?

Unbound sessions are vulnerable to use by anything that gets access to the cookie. That makes any XSS exploit much more serious than otherwise.

> 4) Are the security risks/concerns justification enough to justify a security
> policy of requiring end users to maintain a consistent IP as part of a user
> agreement for use of an application wjhich uses shibboleth-sp.

Nobody can make that decision but you.

-- Scott