Issues with Chrome "prefetching" our IdP pages

[Cantor, Scott]

> Technically I suppose Chrome isn't doing anything wrong because it's a GET
> request which it's free to request whenever it feels like it, but it'd be good if
> there were a way to opt out through headers. I'll try various responses to the
> requests with the "Purpose: prefetch" header.

You're always free to turn off replay checking if that's how you prefer it to work, though that may just move the problem into the flows "proper". I think it's worse to "trap" the user into a login over and over, but obviously what Chrome is doing is far worse than that.

There's the POST binding too of course if you control the SP's behavior.

I have run Chrome to test it and have not seen the behavior, so it does seem to be connected in some way to the SP. I could try some ADFS SPs we have.

-- Scott