is AttributeChecker sessionHook secure?

[Simon Leary]

Hello shib users,
I am interested in deploying the AttributeChecker sessionHook for my SP, but after reading about how it works, I am unsure if I should rely on it for authorization. From what I understand, the user's session is completely set up before they are redirected to the sessionHook. If the user really wanted to, couldn't they just ignore the redirect and use their session cookie to access my site normally? Is there some magic involved where the session is valid only for the sessionHook and nowhere else, or the session expires unless some sort of confirmation is returned from the sessionHook?

Thanks,
Simon

AttributeChecker: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334881/Attribute+Checker+Handler
sessionHook: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334363/RelyingParty