<html><body><div dir="ltr">Thank you Peter! You are correct; I needed the prod; I’ve verified simply adding <script>…</script> to login.vm with the canary token script for users' browser works as advertised.</div><div dir="ltr"><br></div><div dir="ltr">David</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Feb 24, 2023 at 08:16:46, Peter Schober via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div>
<div>
* IAM David Bantz via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> [2023-02-23 21:59]:<br><blockquote type="cite"> Our Security Operations is asking to add a java script to the IdP SSO login<br></blockquote><blockquote type="cite"> page that would detect and record presenting that page from outside our<br></blockquote><blockquote type="cite"> domain. This script depends on using variables like:<br></blockquote><blockquote type="cite"> <br></blockquote><blockquote type="cite"> var l = location.href;<br></blockquote><blockquote type="cite"> var r = document.referrer;<br></blockquote><blockquote type="cite"> <br></blockquote><blockquote type="cite"> I think that would require using the $custom velocity variable<br></blockquote><br>I may be missing something but that JavaScript code is supposed to run<br>in the subject's browser. Why/how would this require server-side<br>variables (velocity or otherwise) to be set?<br><br>I.e., you add the JavaScript file somewhere within edit-webapp/ and<br>reference it from any or all of the templates in views/ (or you add<br>the code inline to the views themselfs) -- and you're done?<br><br>-peter<br>-- <br>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div></body></html>