<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<ul style="margin-top: 0px; margin-bottom: 0px;" data-editing-info="{"applyListStyleFromLevel":false,"unorderedStyleType":4}">
<li style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); list-style-type: "➢ ";">
<div role="presentation" class="elementToProof"><span class="elementToProof">By the time you see a 500 result on one of the bad calls, the idp has</span><br>
<span class="elementToProof">already processed it? I'm not sure what fix could be done after it</span><br>
<span class="elementToProof">happens, short of dynamically blocking the IP so it doesn't make another</span><br>
<span class="elementToProof">request.</span></div>
</li></ul>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Disclaimer: I present the following as the output of a conversation with AI for information only. We haven't tested this as it doesn't affect out day-to-day operation, and we haven't deployed, nor recommend deploying it, in production! If we do get around to
investigating this more fully I'll update..</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
It seems to think that Safari WebKit is hammering retries in the background because it's getting 500 responses on that execution URL, so it proposes using the REDIRECT_STATUS to detect that 500 so it can issue a clean 302 on that URL and WebKit will stop retrying. </div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">RewriteCond %{REQUEST_METHOD} GET</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">RewriteCond %{REQUEST_URI} ^/idp/profile/SAML2/Redirect/SSO$</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">RewriteCond %{QUERY_STRING} (^|&)execution=</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">RewriteCond %{REDIRECT_STATUS} =500</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">RewriteRule ^ /idp/profile/SAML2/Redirect/SSO [R=302,L]</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">Again, we have no idea if this actually works for this issue as we can't reproduce it other than on a production node as it's actually happening in the wild. Based on the few incidents we have looked at it appears to be non-malicious
behaviour of a Safari user agent, and probably wouldn't solve anything else (e.g. bot etc..), and possibly introduces unintended consequences elsewhere.</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Paul B. Henson via users <users@shibboleth.net><br>
<b>Sent:</b> 14 February 2026 03:56<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Cc:</b> Paul B. Henson <henson@acm.org><br>
<b>Subject:</b> Re: NoSuchFlowExecutionException Errors</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 2/13/2026 1:33 AM, John Watt via users wrote:<br>
<br>
> Safari WebKit and has provided a fix for our Apache config involving <br>
> mod_rewrite on "execution" flows that return a 500 - it doesn't seem to <br>
<br>
By the time you see a 500 result on one of the bad calls, the idp has <br>
already processed it? I'm not sure what fix could be done after it <br>
happens, short of dynamically blocking the IP so it doesn't make another <br>
request.<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7CJohn.Watt%40glasgow.ac.uk%7Cb0b242f9fa10443dc92108de6b7d20b5%7C6e725c29763a4f5081f22e254f0133c8%7C1%7C0%7C639066382334070861%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=VnQ%2FMziodsNC23i346YLLyO%2FWKE8BOlCToy4NqzKU2w%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>