<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Not a huge amount to add, sorry, but we've been suffering from this for around a year. The only thing worth mentioning is that in every case we have looked at this seems to be from a Safari user agent. We managed to locate and contact someone while this was
happening and they were a keep-several-dozen-tabs-open-all-the-time kind of browser user, the behaviour didn't stop when the browser was closed, and an extra network process on their Mac seemed to be the source of the traffic.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
We haven't rolled out any solution as adequate log rolling is dealing with the massive warn files, but Copilot is suggesting this is a bug in Safari WebKit and has provided a fix for our Apache config involving mod_rewrite on "execution" flows that return a
500 - it doesn't seem to affect normal operation in testing but we've never been able to trigger this hammering behaviour so won't be rolling it out in prod! </div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Paul B. Henson via users <users@shibboleth.net><br>
<b>Sent:</b> 13 February 2026 03:42<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Paul B. Henson <henson@acm.org><br>
<b>Subject:</b> Re: NoSuchFlowExecutionException Errors</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Fri, Feb 13, 2026 at 02:56:20AM +0000, Hall, Gerry via users wrote:<br>
<br>
> Has anyone else experienced this issue, and if so, did you determine a<br>
> solution?<br>
<br>
This happens when a request shows up that needs state to be processed,<br>
but there is no such state. Taking CAS for example, an initial request<br>
might be:<br>
<br>
<a href="https://idp.cpp.edu/idp/profile/cas/login?service=https://my.cpp.edu/uPortal/Login">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fservice%3Dhttps%3A%2F%2Fmy.cpp.edu%2FuPortal%2FLogin&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806015560%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=E0a0URPNKknRbqyMHb9pg0O%2BZvzgKMoZV6F8dFXnTyQ%3D&reserved=0</a><br>
<br>
No state is required for this call, but it creates state. As the CAS<br>
request is processed back and forth between the browser and the server,<br>
additional calls are made:<br>
<br>
<a href="https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806033787%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oWyfmxZpLeMv2SI7fJxeBsS5uNbof7rMZ%2BNDpcv9PIU%3D&reserved=0</a><br>
<a href="https://idp.cpp.edu/idp/profile/cas/login?execution=e1s2">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s2&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806045778%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2Ft3l3V8lNO97mEmo2Ptfdfni25BWq0aLVcgxtXKjS1M%3D&reserved=0</a><br>
<a href="https://idp.cpp.edu/idp/profile/cas/login?execution=e1s3">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s3&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806063343%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=z8ANd4R6Qw16%2F9uDUCoNx81jC2n5l1qmy6e3rS9LaOc%3D&reserved=0</a><br>
<br>
The eXsX parameter is the Spring Web Flow execution key which defines<br>
what step of the process the call involves. When you properly start a<br>
request which makes state and then make follow up requests that require<br>
state, it knows what to do.<br>
<br>
OTOH, if out of the blue with no state you just call<br>
<a href="https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806076685%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ydOi0QIWjldKKiERC8ySF%2B7HgtQf0LniB9nqxjqOFSE%3D&reserved=0</a>,
it fails with<br>
the error you're seeing. This can happen when a valid user hits the back<br>
button in their browser and re-executes a call whose state has expired.<br>
It can also happen when stupid idiot bots blindly follow URLs they don't<br>
understand 8-/.<br>
<br>
The past week or so I've been getting hundreds of thousands of calls a<br>
day to <a href="https://idp.cpp.edu/idp/profile/cas/login?execution=e1s1">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.cpp.edu%2Fidp%2Fprofile%2Fcas%2Flogin%3Fexecution%3De1s1&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806088454%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=w9XiyztbKUKDZGUkBligHeHUAIjO3TMXorq438v1Qks%3D&reserved=0</a>
from<br>
various IP addresses in Fastly, Cloudflare, AWS, and other places where<br>
users don't generally live. I'm assuming it's an idiot bot, although<br>
it's pretending to be a real user by spoofing the user agent <sigh>.<br>
<br>
It hasn't been affecting the operation of the idp too much other than<br>
it was filling up my log partition as each call generates a huge<br>
backtrace in idp-warn.log.<br>
<br>
There's not much to be done at the idp level, you can't keep people from<br>
making the requests, and that's just what the idp does when it gets<br>
them. The only real option is to shortcut the request at the jetty level<br>
and keep it from getting to the idp, that minimizes the resources it can<br>
suck up.<br>
<br>
If the request includes a session cookie, there's no way to find out if<br>
it's valid without passing through to the idp. But most stupid bots<br>
aren't going to have a session cookie set when they make an invalid<br>
call, so you can check for a URL that requires state, and if it doesn't<br>
have a session cookie, return a 403.<br>
<br>
Unfortunately jetty didn't include a way to do that (well, without<br>
coding a custom java filter and adding a jar), so I ended up submitting<br>
a new rewrite rule:<br>
<br>
<a href="https://github.com/jetty/jetty.project/pull/14488">https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fjetty%2Fjetty.project%2Fpull%2F14488&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806100546%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=4S7tsyydL%2BfVH509Or3lHSfsK9AdAOFMODRrro%2Bgn18%3D&reserved=0</a><br>
<br>
<br>
With this rule, you can do something like this:<br>
<br>
<!-- refuse calls to URLs that require a session when there's no<br>
session cookie --><br>
<Call name="addRule"><br>
<Arg><br>
<New class="org.eclipse.jetty.rewrite.handler.RuleContainer"><br>
<Call name="addRule"><br>
<Arg><br>
<!-- jetty is feature-poor as far as boolean operations on rules, so we<br>
kludge a regex that matches everything but what we want to match --><br>
<New class="org.eclipse.jetty.rewrite.handler.TerminatingRegexRule"><br>
<Set name="regex">^(?!/idp/profile/cas/login\?execution=).*$</Set><br>
</New><br>
</Arg><br>
</Call><br>
<Call name="addRule"><br>
<Arg><br>
<New<br>
class="org.eclipse.jetty.rewrite.handler.ResponseCookieValueRegexRule"><br>
<Set name="cookieName">__Host-JSESSIONID</Set><br>
<Set name="negate">true</Set><br>
<Set name="code">403</Set><br>
</New><br>
</Arg><br>
</Call><br>
</New><br>
</Arg><br>
</Call><br>
<br>
<br>
Any request for a URL with the prefix /idp/profile/cas/login?execution=<br>
that doesn't include a __Host-JSESSIONID cookie immediately gets a 403.<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cc6573e12a0ca4363b39a08de6ab1fa51%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639065509806113232%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GTGPcIBWk90gaKtLOhLwKpwOzh%2Fe4QQfla2JuldB%2BBQ%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>