Session/Cookie Question

[Cantor, Scott]

> I would have expected the IdP to remember the referrer that
> sent it to the IdP in the first place and then re-direct to that
> place when it finished its part.

Even were Referer to matter (that's an untrustable header from the client, so it means nothing), it is not a requirement of any implementation of an SSO protocol to go directly from the resource to the IdP in one hop. So there's no assumption you can make that Referer would be set, or would be the URL a user tried to access. Sometimes it is, sometimes not.

-- Scott