Troubleshooting 'stale request' error

[Jason Rotunno]

Hey Everyone,

We have a user reporting that he gets a stale request error everytime he
tries to authenticate against Shib from a couple of public machines. The
day before we received this ticket we enabled the SameSite filter to
address this very issue. I know that the filter can break older MacOS
Safari users, but this user has always had this problem (and while the
problematic machines are Macs, the problem happens with Chrome
109.0.5414.119 as well as Safari 16.0 17614.1.25.9.10 17614).

Does anyone have any suggestions for troubleshooting the problem? I don't
see anything in the logs.

Also, is there a way to verify that the filter is actually working? I
simply added the following to our idp.xml to enable it:

idp.cookie.sameSite = None
idp.cookie.sameSiteCondition = shibboleth.Conditions.TRUE

I'm not sure if perhaps something else needs to be done for our particular
instance.

Thanks,
Jason

-- 

Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505

*VERIFY before you click!!*
  - Attackers make their emails look like they come from someone they don't.
  - Attackers make links look like they go to websites they don't.
  - Attackers disguise malware as receipts, invoices, faxes, etc.

Forward suspicious emails to phishing at swarthmore.edu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230213/faf8e6db/attachment.htm>