Return 401 on expired/missing session?

[Jim Fox]

My experience is that the 302 redirect is followed, but considered a 
cross-site redirect error by the idp.  This causes a final response code 
of zero, not 200 or 302.  I detect the zero response code to mean the user 
has to reauthenticate.

Jim

On Mon, 9 Apr 2018, Peter Schober wrote:

> Date: Mon, 9 Apr 2018 11:01:27
> From: Peter Schober <peter.schober at univie.ac.at>
> To: users at shibboleth.net
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Return 401 on expired/missing session?
> 
> For an application where the "frontend" is written in JavaScript and
> running in the browser (accessing a server-based "backend" proteced
> with mod_shib) we're having issues with the frontend code not being
> able to detect that the Shib session has meanwhile expired:
> All HTTP 30x codes returned are transparently followed by the JS code
> (according to some XHR spec) and so far attempts at intercepting those
> redirects in the JS framework used have failed.
>
> Is there an easy way to have mod_shib (or httpd) return, say, HTTP 401
> instead of a redirect to the IDP (or SAMLDS) in case where no valid
> session exists?
> Obviously that would leave people stuck but I guess we could let them
> initiate a new session using the SP's Login handler (manually or in
> this case via the "frontend" application that would detect this status
> code and initate a new session automatically).
>
> I feel I must be missing something obvious..
>
> -peter
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>