browser private window activation condition

[Timo Tunturi]

I'm not worried about getting in trouble for trying to detect incognito 
windows for this kind of a purpose that isn't nefarious at all. Maybe I 
should. Hehe.

But in any case since there is no straightforward way to do that 
server-side or relay that information from the client-side to the 
server-side I'll just leave this one to maybe be solved another day.

- Timo

On 18/02/2025 15.36, Timothy Spear via users wrote:
> I hesitate to suggest it. But, you can use techniques for browser
> fingerprinting. This will give you a very high confidence level, but not
> certainty that the browser is constant. There are a number of solutions to
> calculate the fingerprint, with varying levels of accuracy and complexity.
> Note: This is the technique Google got in trouble with recently for
> identifying browsers even in incognito mode.
> 
>  From there, you could leverage what Scott suggested for being able to pull
> the state and context and restore it to the browser session.
> 
> Tim
> 
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via
> users
> Sent: Tuesday, February 18, 2025 8:29 AM
> To: Shib Users <users at shibboleth.net>
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Subject: Re: browser private window activation condition
> 
>> Is such interaction between server-side code and browser -side
>> javascript possible? Or is there some other way to do  what I want to
>> do?
> 
> I'm sure there's some insanely complex sort of approach involving Javascript
> submitting data to some custom endpoint that stores off state and an
> activation condition using that to read back the state, but definitely
> nothing I would advise doing.
> 
> I did build a basically undocumented REST API for the storage service in the
> IdP. I think I went pretty far with it even allowing specific storage
> contexts to be controlled with custom access control rules. Having said
> which, I probably wouldn't advise exposing it that way to the open internet,
> but in theory it is coded to allow for that.
> 
> Short of that, I can't see any obvious way it could be done unless relying
> on the browser sending a custom header is an option (i.e. having the users
> themselves actually adjust things on their end with a browser add-on).
> 
> -- Scott
> 
> 
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw>> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>