SP Address Checking From Web Server as Source

[Cantor, Scott]

> Agreed that this is messy. There is propagation of cookies
> based on the type of request, and we've tried including and
> excluding _shibsession to no success.

You can't even count on that name. At best you need to send "everything that should be sent with that request", i.e. not by picking and choosing.

> Another question though...is there any other risk that's being
> mitigated by the consistentAddress attribute on the Sessions
> element other than a _shibsession cookie being stolen from
> a compromised client?

No.

> If the transport channel is https, can the _shibsession cookie
> be forged any other way than extracting it from the browser?

It's random, not cryptographic. Forging is a matter of probability or figuring out the right session ID.

I thought of a possible way around this, which is IP6. The sessions bind to both address types. If you use IP4 and do a loopback over IP6 or vice versa, I don't think it will fail.

But as I say, you cannot depend on knowing the cookie names, that's not allowed.

-- Scott