OIDC Authorization code affinity loadbalancing

[Simon Lundström]

> On 2 Sep 2026, at 18:08, Scott Cantor via users <users at shibboleth.net> wrote:
> 
>> Since POST can be used, that alone seemed to be a dealbreaker...
> 
> I guess you did address that. I would have assumed that to be impossible since it means buffering the request body in the load balancer, I just figured they'd rule that out of bounds. (Like in Apache, you can only read it once, so calling the APIs again won't work.)

Exactly so. The magic of MITM and TCL!

Thanks for the look!

BR,
- Simon