adding script to IdP login to detect faked copy

[IAM David Bantz]

Our Security Operations is asking to add a java script to the IdP SSO login
page that would detect and record presenting that page from outside our
domain. This script depends on using variables like:

 var l = location.href;
 var r = document.referrer;


I think that would require  using the $custom velocity variable analogous
to what’s documented for adding logging:
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1424851284/Logging+Inside+IdP+Views

(I’m supposing any sophisticated attempt to clone could simply remove any
reference to such a script, but perhaps it’s worthwhile catching naive
attempts - anyway, that’s outside the scope of my query here.)

Has anyone implemented something similar (or dissimilar deployment to the
same end of detecting spoofed login page)?
Thanks for any hints, warnings, even dope-slaps if warranted.

David St Pierre Bantz
University of Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230223/c2208ccc/attachment.htm>