Session/Cookie Question

[Dave Perry]

Speaking as an app developer, who also maintains an IdP - my view is that you would have ToS acceptance recorded in the application.

HTH
Dave

Sent from Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Check via users <users at shibboleth.net>
Sent: Thursday, January 2, 2025 7:52:20 PM
To: Cantor, Scott <cantor.2 at osu.edu>
Cc: Check <mrcheck at gmail.com>; Shib Users <users at shibboleth.net>
Subject: Re: Session/Cookie Question

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.

You know WAY more about how all this works so I apologize for my ignorance.  Maybe it's the "response location" I'm looking for and just can't find it.

Let's use the Terms of Use as an example as I just tested this a few minutes ago.

When I type https://mySP.com/Page1<https://mysp.com/Page1> or https://mySP.com/Page2<https://mysp.com/Page2>, the IdP prompts me for my cert and PIN, then takes me to the proper location, Page1 or Page2.

Is Page1 or Page2 contained in the "response location"?  If so, where is that saved at?  Cookie?  Session variable?  Basically, how could I show this on the page?

"You were trying to get to https://mySP.com/Page1<https://mysp.com/Page1>.  To do so, you must first accept our Terms of Use."

If it's saved somewhere else, where is that somewhere else?

Thanks a bunch,

Robert "Check" Adamczyk




On Thu, Jan 2, 2025 at 1:30 PM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
> How does it know where the user was heading to?

It doesn't, that's all up to the SP to handle. The things an IdP knows are the identity of the SP, the response location (from the metadata), and the state token, which is opaque.

Of those, the identity of the SP is the only relevant bit that can be used in any sort of "what was the user trying to do?" sense.

-- Scott


[York St John University is the University of the Year for Social Inclusion in The Times and Sunday Times Good University Guide 2025]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250102/1394ca3c/attachment.htm>