Getting Shibboleth attributes into client-side Javascript applications

[Cantor, Scott]

> The guidance I've offered so far has been limited to an intermediate piece
> between the authentication and the loading of the Javascript that copies
> attributes into a cookie or just building native authentication (usually OIDC)
> into the Javascript. Neither are ideal as they're both full of potential large
> security pitfalls.

I'm gonna go out on a limb and say that the basic concept of client side apps is itself already a large security pitfall and that I'd be fascinated to understand what they think they could do to make anything they're doing for security more than theater anyway.

In terms of your question:
> If the session handler isn't suited to this, I'd welcome other guidance.

It was not meant for that originally but later on it was modified to add JSON output as an option and I suspect this kind of thing was why. I have never used it in that way because I think you'd have to relax the HttpOnly property on the SP's cookies.

No matter how you did it, there'd have to be some kind of means to secure the access to the dump resource, and I don't know how to do that really, other than the existing cookie, which opens up a huge new attack space by allowing scripts to use it.

I'm sure there's some kind of convoluted trick that avoids the HttpOnly problem, but I don't know what it is.

-- Scott