<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 04/12/2016 11:10 AM, Marvin Addison
wrote:<br>
</div>
<blockquote
cite="mid:CACOs9MR3Xj=yFDAphW+NqpVe=ENUsj3McugRbUru=ZQvqBYvtw@mail.gmail.com"
type="cite">
<meta http-equiv="Context-Type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_quote">
<div dir="ltr">On Tue, Apr 12, 2016 at 10:52 AM O'Dowd, Josh
<<a moz-do-not-send="true"
href="mailto:Josh.O%27Dowd@mso.umt.edu">Josh.O'Dowd@mso.umt.edu</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote">Does a 'return' parameter in
the logout URL seem a prudent enhancement , since the
NativeSP has that functionality and Jasig CAS offers that
capability as well?<br>
</blockquote>
<div><br>
</div>
<div>I'm not in favor of it. The return parameter was never
specified in the CAS protocol v2 spec, and its introduction
into the Jasig CAS server was (to me) a curious addition.
I'm unaware of the use cases that drove its creation, but I
am aware that it was the source of at least one security
issue (XSS vector). Maybe if you could articulate the value
I'd be more willing, but I just don't understand what value
it provides.</div>
<div><br>
</div>
<div>M<br>
</div>
<div><br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
We have a few use cases for this. The one we are getting the most
push back for now that it no longer works is this.... We have a
kiosk computer in an office where users log in, fill out a form,
then log out. They really want the browser to end up back on the
form page but logged out so when the next user gets to the computer
it is all set for them. With our old CAS server, this worked well
for them.<br>
<br>
A 'return' parameter in the logout URL similar to what Jasig CAS
offers would be great for our needs.<br>
<br>
Thanks,<br>
Dan Oachs<br>
<br>
</body>
</html>