is AttributeChecker sessionHook secure?

[Peter Schober]

Peter Schober via users <users at shibboleth.net> [2026-09-16 14:52 CEST]:
> Scott Cantor via users <users at shibboleth.net> [2026-09-15 16:15 CEST]:
> > > I am interested in deploying the AttributeChecker sessionHook for my SP, but after reading about how it works, I am unsure if I should rely on it for authorization.
> > 
> > It's not for authorization, it's for guarding use of a session so that you have a controlled point to handle errors rather than leaving it to later code that might not handle them as gracefully. I added a note to the handler regarding that.
> > 
> > No reliable authorization step can function anywhere but directly in
> > the path of actual resource access.
> 
> Well, you can nuke any cookies as part of the sessionHook (e.g. after
> some process determined that access to the protected resource couldn't
> possibly work).
> Not sure that falls under your definition of "reliable", of course.

But yeah, to both your points, whateever code I put into my
sessionHook may actually not run.

-peter