adding script to IdP login to detect faked copy

[Peter Schober]

* IAM David Bantz via users <users at shibboleth.net> [2023-02-23 21:59]:
> Our Security Operations is asking to add a java script to the IdP SSO login
> page that would detect and record presenting that page from outside our
> domain. This script depends on using variables like:
> 
>  var l = location.href;
>  var r = document.referrer;
> 
> I think that would require  using the $custom velocity variable

I may be missing something but that JavaScript code is supposed to run
in the subject's browser. Why/how would this require server-side
variables (velocity or otherwise) to be set?

I.e., you add the JavaScript file somewhere within edit-webapp/ and
reference it from any or all of the templates in views/ (or you add
the code inline to the views themselfs) -- and you're done?

-peter