Logout propagation causes empty download

[Stephen Graham]

[laugh]         Stephen Graham reacted to your message:
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Pete Birkinshaw <pete at digitalidentitylabs.com>
Sent: Thursday, March 26, 2026 11:33:57 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Logout propagation causes empty download

Thanks!

I was so focused on the issue being CSP in the old IdP views or Safari, I didn't wonder if it could be CSP on the SP.

I also didn't read the IdP docs properly, which say:

  Common errors can be:
  * The SP’s web Server has set the X-Frame-Options to “sameorigin”, which will make the SLO response from SP to IdP fail.

The SP is indeed setting that header to "sameorigin".

The functionality of X-Frame-Options has been reduced in modern browsers so it needs to be fixed with CSP headers instead.

It will take awhile to actually test this, but so far it seems like a very likely cause of the problem.

Thanks,

Pete

--
Pete Birkinshaw


From: Scott Cantor via users <users at shibboleth.net><mailto:users at shibboleth.net>
Reply: Shib Users <users at shibboleth.net><mailto:users at shibboleth.net>
Date: 25 March 2026 at 14:55:26
To: Shib Users <users at shibboleth.net><mailto:users at shibboleth.net>
Cc: Scott Cantor <scott at restingparrotsoftware.com><mailto:scott at restingparrotsoftware.com>
Subject:  Re: Logout propagation causes empty download



> On Mar 25, 2026, at 9:28 AM, Pete Birkinshaw <pete at digitalidentitylabs.com> wrote:
>
> Has anyone else seen global logout on an IdP cause Safari to download an empty file?

OSU's IdP isn't exhibiting that from what I can see, but I'll have to make sure I'm testing with something that it would actually send a logout to, as that's very rare.

Our propagation results UI is hidden (as it's not accessible), so it's possible that masks the behavior, but since the underlying iframes are hidden either way, I wouldn't think it would make a difference whether the Javascript signaling is visible or not.

I would tend to think it's to do with the SP it's trying to send to more than anything else.

-- Scott

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260326/f2b818f4/attachment.htm>