browser private window activation condition

[n614cd at gmail.com]

I hesitate to suggest it. But, you can use techniques for browser
fingerprinting. This will give you a very high confidence level, but not
certainty that the browser is constant. There are a number of solutions to
calculate the fingerprint, with varying levels of accuracy and complexity.
Note: This is the technique Google got in trouble with recently for
identifying browsers even in incognito mode.

>From there, you could leverage what Scott suggested for being able to pull
the state and context and restore it to the browser session.

Tim

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via
users
Sent: Tuesday, February 18, 2025 8:29 AM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: browser private window activation condition

> Is such interaction between server-side code and browser -side 
>javascript possible? Or is there some other way to do  what I want to 
>do?

I'm sure there's some insanely complex sort of approach involving Javascript
submitting data to some custom endpoint that stores off state and an
activation condition using that to read back the state, but definitely
nothing I would advise doing.

I did build a basically undocumented REST API for the storage service in the
IdP. I think I went pretty far with it even allowing specific storage
contexts to be controlled with custom access control rules. Having said
which, I probably wouldn't advise exposing it that way to the open internet,
but in theory it is coded to allow for that.

Short of that, I can't see any obvious way it could be done unless relying
on the browser sending a custom header is an option (i.e. having the users
themselves actually adjust things on their end with a browser add-on).

-- Scott


--
For Consortium Member technical support, see
https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net