Return 401 on expired/missing session?

[Peter Schober]

* Jim Fox <fox at washington.edu> [2018-04-09 20:12]:
> My experience is that the 302 redirect is followed, but considered a
> cross-site redirect error by the idp.  This causes a final response code of
> zero, not 200 or 302.  I detect the zero response code to mean the user has
> to reauthenticate.

Ah, I think I see what you mean. After the IDP internal redirects
trigger the CORS error...

  Failed to load https://idp.example.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=...
  Redirect from
  'https://idp.example.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=...'
  to
  'https://idp.example.org/idp/profile/SAML2/Redirect/SSO;jsessionid=...?execution=e1s1'
  has been blocked by CORS policy: No 'Access-Control-Allow-Origin'
  header is present on the requested resource. Origin
  'https://sp.example.net' is therefore not allowed access.

I do seem to end up with a status code of zero due to "unknown error":

HttpErrorResponse {headers: HttpHeaders, status: 0, statusText: "Unknown Error", url: null, ok: false, …}

I'll pass this on to the developer, maybe we can work with this.

Thanks,
-peter