Logout notifications always red X (failed)

[Petr Hroudný]

st 11. 8. 2021 o 23:35 Cantor, Scott <cantor.2 at osu.edu> napísal(a):

>
> The reporting is very difficult to debug but a look at a javascript
> console might reveal an incompatibility of some kind.
>
> Getting a peek at the HTML coming back in the frames is the only other way
> to really gauge what might be happening.
>

The console revealed this:

The loading of “
https://........../idp/profile/SAML2/Redirect/SLO?SAMLResponse=
<https://idp.stuba.sk/idp/profile/SAML2/Redirect/SLO?SAMLResponse=fZFPa8MwDMW%2FSvC9sZ26%2BWOawFgvhY5BU3rYpdiJspqldogcuo%2B%2FJKWsg9Gj0Ht6%2BklrVJe2kzv36Qa%2FB%2BycRQi%2BL61FObdyMvRWOoUGpVUXQOkrWb687WQUMtn1zrvKtSTYAHpjlTfO5uTsfYeSUlN3IfpBqxC%2FpoKO%2Bsa0QKcBEd1DbXqoPC137yTYbnJySoXQSiQV56DqOKsTvUpExpmOeZxmKR9l9r7mwY0GxldxEydCNdlyCVmcpGKlRSwSVacRbyYD4gBbi15Zn5OIRXzB0gWPDiyVLJOMfZDgCD3Om49QpFhP5HL29Q%2B3eH4KhQj9hE%2BKO%2F71eg1RNWDqiR%2FPRmvXgj%2Bv6UPALa2TpVd%2BwL%2FVq6shOKp2gOfZOKtlOVQVIBJa3BJ%2Bh9L%2F3lz8AA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=oa3as%2FX60GhW5I74wFW80xu2vUhYH48xgd1heSMs%2FWZrmN28gLowLpLTlQ09r9DkzLIRZLtK21KGPTKukBu6mHgrXf9qMpjyWMYHXNv%2F%2BR0s1EJTcTRtHY1SXJFMJDV9eodrecbmUi7mxou61%2Bnnt2FY2AYVacLjMSicI9xA%2FvxKUmkvMNYXp9ITjWTpiVll9xdNIXraRX8zommH9U10wKy%2BRWmVev%2BPonMP2yXGYMzyD2CaU9kfbQK5WbnjWQULCWgRxx8jR7ljx9E4aYi5JSM1D7xsKbR7w4CmuIAuCqz%2FlPS5eo%2BmFEk6OYBINhzxD8QDvO8TeRqSjnVerxNq8FRM5isNK1XpMX0aosiRXMZydIPrwIe91eNBXYKcAPob%2BK6ILHS%2BadSUZZ6PjmGbqb77l06fk%2BnPbmbHfGk13JTFZscJK0O%2FFaOdThW3mEAriF23G8S7teSRub1alKyz5jAbg%2BKeZRjPmbFxtdDmqm9YuLDPICl50MeyhROTJadJ>.....
in a frame is denied by “X-Frame-Options“ directive set to “DENY“.

Tried to set idp.frameoptions to SAMEORIGIN or empty, but it's apparently
buggy:

- during SSO, it produces:

*X-Frame-Options*: DENY, SAMEORIGIN

- during SLO, idp.frameoptions is completely ignored, and DENY is hardcoded
at some other place:

*X-Frame-Options*: DENY

Thanks, Petr
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210812/1390f638/attachment.htm>