Back button issue

[Lee, Dong]

First of all, thank you all for your support.

I had a working session with a user and discovered that he had multiple tabs open in his browser, some of which he had kept open for several days. I asked him to restart his browser, but instead, he restarted his laptop.  After the restart, SSO began working without any problems.

Dong Lee

Identity Management & System Integration
Center for Information Technology Services
University of Maryland, Baltimore
410-706-3027
dlee at umaryland.edu


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
Sent: Friday, January 31, 2025 1:29 PM
To: Lazar, Michael E <michael.lazar at csun.edu>; Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: Back button issue

CAUTION: This message originated from a non-UMB email system. Hover over any links before clicking and use caution opening attachments.

> My hunch is that this is somehow JSESSIONID related, but I'm looking
> for more data about why this issue is happening.

I'd be more focused on tracing requests and cookies, the log's not going to tell you anything it didn't already tell you. It can't, there's nothing there for it to elaborate on, it has no state to log.

I know of no causes other than the ones I stated, and I didn't think there was anything unusual about listing them. Mostly in case I'm forgetting one somebody can point to, but I also forgot to note that the client can easily cause all sorts of issues when it isn't compliant, they just end up being one of the actual causes I mentioned in the end.

Chrome for example is very broken, and it can cause the JSESSIONID issue because it sometimes issues duplicate requests and mis-associates the cookies it gets back. If it sends two requests, gets back two different cookies, but holds on to the first one and sends it back later on, the server has moved on to the second and so it's out of sync. There's nothing the server can do about it.

That's just a specific case of the JSESSIONID not lining up.

It does similar thiings with form contents, which is why it broke the CSRF support we built in in a similar way by holding on to the wrong CSRF token.

In your example, something else is probably going on that coincides with that sequence of steps but it isn't directly caused by them, at least not if that's actual exception. As I said, that error page is a catch all for lots of different scenarios and different logged exceptions. That exception is probably one of the "simpler" ones that manifests.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net