is AttributeChecker sessionHook secure?

[Scott Cantor]

> I am interested in deploying the AttributeChecker sessionHook for my SP, but after reading about how it works, I am unsure if I should rely on it for authorization.

It's not for authorization, it's for guarding use of a session so that you have a controlled point to handle errors rather than leaving it to later code that might not handle them as gracefully. I added a note to the handler regarding that.

No reliable authorization step can function anywhere but directly in the path of actual resource access.

-- Scott