adding script to IdP login to detect faked copy

[IAM David Bantz]

Thank you Peter! You are correct; I needed the prod; I’ve verified simply
adding <script>…</script> to login.vm with the canary token script for
users' browser works as advertised.

David

On Feb 24, 2023 at 08:16:46, Peter Schober via users <users at shibboleth.net>
wrote:

> * IAM David Bantz via users <users at shibboleth.net> [2023-02-23 21:59]:
>
> Our Security Operations is asking to add a java script to the IdP SSO login
>
> page that would detect and record presenting that page from outside our
>
> domain. This script depends on using variables like:
>
>
>  var l = location.href;
>
>  var r = document.referrer;
>
>
> I think that would require  using the $custom velocity variable
>
>
> I may be missing something but that JavaScript code is supposed to run
> in the subject's browser. Why/how would this require server-side
> variables (velocity or otherwise) to be set?
>
> I.e., you add the JavaScript file somewhere within edit-webapp/ and
> reference it from any or all of the templates in views/ (or you add
> the code inline to the views themselfs) -- and you're done?
>
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230224/ec1b8356/attachment.htm>