IIS Module Intermittently Failing to Query Daemon over a TCPListener for Session Information

[Cantor, Scott]

On 7/20/21, 12:24 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at signet.id> wrote:

>    iframes are littered throughout the application.  I don't know which HTTP method they use, I'm aware of the
> CSRF implications, and they have been evaluated to the best of our present ability.

Frames are actually going to break it regardless, which I didn't realize until today. SameSite=None is the only way to get a cookie to work if the frame differs from the top level origin, regardless of the method. Lax and GET don't work.

I had an application that forced frames on the IdP and it required me to implement the IdP filter, and that's why. I updated the documentation to reflect that.

-- Scott