NoSuchFlowExecutionException Errors

John Watt John.Watt at glasgow.ac.uk
Fri Feb 13 09:33:59 UTC 2026 

Not a huge amount to add, sorry, but we've been suffering from this for around a year. The only thing worth mentioning is that in every case we have looked at this seems to be from a Safari user agent. We managed to locate and contact someone while this was happening and they were a keep-several-dozen-tabs-open-all-the-time kind of browser user, the behaviour didn't stop when the browser was closed, and an extra network process on their Mac seemed to be the source of the traffic.

We haven't rolled out any solution as adequate log rolling is dealing with the massive warn files, but Copilot is suggesting this is a bug in Safari WebKit and has provided a fix for our Apache config involving mod_rewrite on "execution" flows that return a 500 - it doesn't seem to affect normal operation in testing but we've never been able to trigger this hammering behaviour so won't be rolling it out in prod!

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Paul B. Henson via users <users at shibboleth.net>
Sent: 13 February 2026 03:42
To: Shib Users <users at shibboleth.net>
Cc: Paul B. Henson <henson at acm.org>
Subject: Re: NoSuchFlowExecutionException Errors

On Fri, Feb 13, 2026 at 02:56:20AM +0000, Hall, Gerry via users wrote:

> Has anyone else experienced this issue, and if so, did you determine a
> solution?

This happens when a request shows up that needs state to be processed,
but there is no such state. Taking CAS for example, an initial request
might be:

https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fservice%3Dhttps%3A%2F%2Fmy.cpp.edu%2FuPortal%2FLogin&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806015560%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=E0a0URPNKknRbqyMHb9pg0O%2BZvzgKMoZV6F8dFXnTyQ%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?service=https://my.cpp.edu/uPortal/Login>

No state is required for this call, but it creates state. As the CAS
request is processed back and forth between the browser and the server,
additional calls are made:

https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806033787%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oWyfmxZpLeMv2SI7fJxeBsS5uNbof7rMZ%2BNDpcv9PIU%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1>
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s2&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806045778%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2Ft3l3V8lNO97mEmo2Ptfdfni25BWq0aLVcgxtXKjS1M%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?execution=e1s2>
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s3&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806063343%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=z8ANd4R6Qw16%2F9uDUCoNx81jC2n5l1qmy6e3rS9LaOc%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?execution=e1s3>

The eXsX parameter is the Spring Web Flow execution key which defines
what step of the process the call involves. When you properly start a
request which makes state and then make follow up requests that require
state, it knows what to do.

OTOH, if out of the blue with no state you just call
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806076685%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ydOi0QIWjldKKiERC8ySF%2B7HgtQf0LniB9nqxjqOFSE%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1>, it fails with
the error you're seeing. This can happen when a valid user hits the back
button in their browser and re-executes a call whose state has expired.
It can also happen when stupid idiot bots blindly follow URLs they don't
understand 8-/.

The past week or so I've been getting hundreds of thousands of calls a
day to https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806088454%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=w9XiyztbKUKDZGUkBligHeHUAIjO3TMXorq438v1Qks%3D&reserved=0<https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1> from
various IP addresses in Fastly, Cloudflare, AWS, and other places where
users don't generally live. I'm assuming it's an idiot bot, although
it's pretending to be a real user by spoofing the user agent <sigh>.

It hasn't been affecting the operation of the idp too much other than
it was filling up my log partition as each call generates a huge
backtrace in idp-warn.log.

There's not much to be done at the idp level, you can't keep people from
making the requests, and that's just what the idp does when it gets
them. The only real option is to shortcut the request at the jetty level
and keep it from getting to the idp, that minimizes the resources it can
suck up.

If the request includes a session cookie, there's no way to find out if
it's valid without passing through to the idp. But most stupid bots
aren't going to have a session cookie set when they make an invalid
call, so you can check for a URL that requires state, and if it doesn't
have a session cookie, return a 403.

Unfortunately jetty didn't include a way to do that (well, without
coding a custom java filter and adding a jar), so I ended up submitting
a new rewrite rule:

        https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fjetty%2Fjetty.project%2Fpull%2F14488&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806100546%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=4S7tsyydL%2BfVH509Or3lHSfsK9AdAOFMODRrro%2Bgn18%3D&reserved=0<https://github.com/jetty/jetty.project/pull/14488>


With this rule, you can do something like this:

        <!-- refuse calls to URLs that require a session when there's no
session cookie -->
        <Call name="addRule">
          <Arg>
            <New class="org.eclipse.jetty.rewrite.handler.RuleContainer">
              <Call name="addRule">
                <Arg>
                  <!-- jetty is feature-poor as far as boolean operations on rules, so we
                       kludge a regex that matches everything but what we want to match -->
                  <New class="org.eclipse.jetty.rewrite.handler.TerminatingRegexRule">
                    <Set name="regex">^(?!/idp/profile/cas/login\?execution=).*$</Set>
                  </New>
                </Arg>
              </Call>
              <Call name="addRule">
                <Arg>
                  <New
class="org.eclipse.jetty.rewrite.handler.ResponseCookieValueRegexRule">
                    <Set name="cookieName">__Host-JSESSIONID</Set>
                    <Set name="negate">true</Set>
                    <Set name="code">403</Set>
                  </New>
                </Arg>
              </Call>
            </New>
          </Arg>
        </Call>


Any request for a URL with the prefix /idp/profile/cas/login?execution=
that doesn't include a __Host-JSESSIONID cookie immediately gets a 403.

--
For Consortium Member technical support, see https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806113232%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GTGPcIBWk90gaKtLOhLwKpwOzh%2Fe4QQfla2JuldB%2BBQ%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260213/4e0f2b13/attachment.htm>

More information about the users mailing list