is AttributeChecker sessionHook secure?

[Peter Schober]

Scott Cantor via users <users at shibboleth.net> [2026-09-15 16:15 CEST]:
> > I am interested in deploying the AttributeChecker sessionHook for my SP, but after reading about how it works, I am unsure if I should rely on it for authorization.
> 
> It's not for authorization, it's for guarding use of a session so that you have a controlled point to handle errors rather than leaving it to later code that might not handle them as gracefully. I added a note to the handler regarding that.
> 
> No reliable authorization step can function anywhere but directly in
> the path of actual resource access.

Well, you can nuke any cookies as part of the sessionHook (e.g. after
some process determined that access to the protected resource couldn't
possibly work).
Not sure that falls under your definition of "reliable", of course.

-peter