Issues with Chrome "prefetching" our IdP pages

[Cantor, Scott]

> Actually I think that chrome is indeed doing something "wrong" here, as typing
> an SP URI in Chrome browser will cause a background "prefetch" request to the
> SP which under certain circumstances** will cause subsequent prefetch to the
> IDP followed by a Replay Attack warning (in the IDP logs) once the user finishes
> typing the SP URI and presses enter (header is: "Purpose: prefetch")

But the point is that in HTTP a GET is supposed to be idempotent, and SSO protocols with message IDs and replay checking break that rule. Really the best thing to do is use POST for requests and that is perfectly allowed in SAML.

But as Nate said, my opinion on replay checks is about usability, not security. There is no good outcome that will ever be possible from a replay, and it's simply a matter of opinion what the "best" bad option is for usability.

We should have exposed an option to disable the checking but I don't think it ever got filed as a RFE so I never got around to it. It's possible, just not clean.

-- Scott