Shibboleth SP: Data loss when a POST triggers a redirect to re-authenticate

[Tom Noonan]

Oh, fantastic.  Thanks for drawing my attention to that.  Looking over the
docs I'm not fully clear on how it works.  So I will need a StorageService,
which I specify with the postData attribute.  Is the form something generic
that's called on redirects with POSTs, or is that an example of fields we
need to build into our app?  I"m fuzzy on how the postTemplate form fits in.

--Tom Noonan II


On Fri, Feb 8, 2019 at 9:50 AM Scott Koranda <skoranda at gmail.com> wrote:

> > Good morning:
> >
> > We're experiencing a pain point with the SP and I wanted to see if there
> is
> > some advice on how to mitigate it.  We're using the Shibboleth SP with
> > Apache as a transparent authenticating proxy in front of our app, and our
> > app which allows data entry via HTTP POST requests.  We're seeing issues
> > where the user submits data via a HTTP post, but their session with the
> SP
> > has expired so the SP redirects to the IdP to re-authenticate.  When the
> > reauthentication happens the POST data is lost.  We do have our session
> > timeout values turned up but that is only reducing the probability of
> this
> > error, not fully preventing against it.
> >
> > My understanding is that this is a protocol level problem, and that it
> > isn't possible to maintain the POST data through the redirect.  Is that
> > correct?  Are there any quick wins to defend against this we can
> > implement?
>
> Please see the options 'postData' and 'postTemplate' at
>
> https://wiki.shibboleth.net/confluence/display/SP3/Sessions
>
> You may also want to investigate 'postExpire' and 'postLimit'.
>
> Please note that using 'postData' is limited to Content-Type
> application/x-www-form-urlencoded.
>
> Scott K
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190208/511acab1/attachment.html>