<div dir="ltr"><div dir="ltr">On Wed, May 15, 2019 at 5:27 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> Does that seem reasonable?<br>
<br>
I'm a bad choice to comment, but my feeling is that opening up any IdP path to CORS essentially guarantees malware exfiltration of sessions. This is either decently mitigated by network bound sessions or not, based on how hard you think client IP spoofing is.<br></blockquote><div><br></div><div>It is basically implementing what's described at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources">https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources</a></div><div>The SAML endpoints would suffer from the same vulnerable, right?</div><div><br></div><div>Liam</div></div><div name="sortd_readrcpt" style="max-width:0;max-height:0;overflow:hidden"><img alt="" style="width:0;max-height:0;overflow:hidden;" src="https://app.sortd.com/rr/5cdcb8086cdc02758313bde8?from=c9d5bd757ef464da4b7b9dfb04f879b5"></div></div>