<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Thanks Peter !</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Maybe some of us should centralize and synthesize information about how to secure SPA and web services with Shibboleth / SAML?<br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font color="#888888"><span><p dir="ltr" style="line-height:1.656;margin-left:4pt;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:267px;height:56px"><img src="https://lh5.googleusercontent.com/mLThoaiNugBlY4336DnmDiuIG7T4T71JCb3kLkYrOMcE-1nM3a1lA0fpE33NtqLXdQp8lUz4a4inFD0brKSjQaBudko0GGV3VfNTExNt3kX1_2QriimWy587sTrXfElf-Y435tWF" style="margin-left:0px;margin-top:0px" width="267" height="56"></span></span></p><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:10pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap">Fabien Berteau </span><span style="font-size:9.5pt;font-family:Verdana;color:rgb(61,133,198);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap">|</span><span style="font-size:10pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap"> Security Architect</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Bordeaux</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:9.5pt;font-family:Verdana;color:rgb(17,85,204);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><a href="mailto:aurelien.lajoie@manomano.com" target="_blank">fabien.berteau@manomano.com</a></span></p></span></font></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le jeu. 21 oct. 2021 à 18:26, Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* Fabien BERTEAU <<a href="mailto:fabien.berteau@manomano.com" target="_blank">fabien.berteau@manomano.com</a>> [2021-10-21 14:51]:<br>
> I thought I could avoid ECP in our SPAs by forcing the user to authenticate<br>
> in order to download the SPA (classic SP initiated browser flow), then by<br>
> embedding the SP session cookie during each call to a web service based on<br>
> XMLHTTPRequest (same domain, so the browser should add it ?). Am I wrong ?<br>
<br>
Maybe some of these posts (or threads) are of help to you:<br>
<br>
<a href="https://shibboleth.net/pipermail/users/2018-April/039942.html" rel="noreferrer" target="_blank">https://shibboleth.net/pipermail/users/2018-April/039942.html</a><br>
<br>
<a href="https://shibboleth.net/pipermail/users/2018-July/041162.html" rel="noreferrer" target="_blank">https://shibboleth.net/pipermail/users/2018-July/041162.html</a><br>
<br>
<a href="https://shibboleth.net/pipermail/users/2018-November/042324.html" rel="noreferrer" target="_blank">https://shibboleth.net/pipermail/users/2018-November/042324.html</a><br>
<br>
Best,<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>