<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 7/2/2020 10:57 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:1F447E74-E8D0-4A75-9823-3D3D858B7F0D@osu.edu">
<pre class="moz-quote-pre" wrap="">On 7/2/20, 11:20 AM, "users on behalf of Joseph Fischetti" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofJoseph.Fischetti@marist.edu" moz-do-not-send="true"><users-bounces@shibboleth.net on behalf of Joseph.Fischetti@marist.edu></a> wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">Is there any way to force the JSESSIONID to exist in the flowExecutionUrl (i.e. it doesn't always), or is it available as a
variable I can access in a velocity template?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">That's terrible security practice, but it won't matter anyway.
It's already in a cookie, and if the cookie isn't sent back, nothing's going to work right anyway. And if the session is actually just expired, including it in the URL won't help.
Whatever you're doing either isn't technically possible or it's relying on the session lasting long enough, which there's no guarantee of (but the timeout value is not up to the IdP, it's set by the container, and is changeable).</pre>
</blockquote>
<p>Does SameSite come into play in this situation?<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>