<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
<!--
body
{font-family:Helvetica,Arial;
font-size:13px}
-->
</style>
</head>
<body>
<table cellspacing="0" cellpadding="0" border="0" style="background:#EFF6FC; width:100%; border-radius:10px; border-collapse:separate; border:1px; border-radius:6px; margin-bottom:12px">
<tbody style="font-family:-apple-system,Segoe UI,HelveticaNeue-Bold,Helvetica Neue Bold,Helvetica Neue,Helvetica,Arial,sans-serif; font-size:20px">
<tr>
<td style="padding:5px 15px">
<table style="width:100%">
<tbody style="font-family:-apple-system,Segoe UI,HelveticaNeue-Bold,Helvetica Neue Bold,Helvetica Neue,Helvetica,Arial,sans-serif">
<tr>
<td>
<table style="border-spacing:0">
<tbody style="font-family:-apple-system,Segoe UI,HelveticaNeue-Bold,Helvetica Neue Bold,Helvetica Neue,Helvetica,Arial,sans-serif">
<tr>
<td><img alt="laugh" src="https://outlook-1.cdn.office.net/assets/reaction/laugh.png" style="height:25px; width:25px">
</td>
<td><span style="font-weight:bold; padding-left:3px">Stephen Graham</span> <span>
reacted to your message:</span> </td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Pete Birkinshaw <pete@digitalidentitylabs.com><br>
<b>Sent:</b> Thursday, March 26, 2026 11:33:57 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Logout propagation causes empty download</font>
<div> </div>
</div>
<div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
Thanks!</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
I was so focused on the issue being CSP in the old IdP views or Safari, I didn't wonder if it could be CSP on the SP.</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
I also didn't read the IdP docs properly, which say:</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial; font-size:13px; margin:0px; line-height:auto">
<br>
</div>
<div id="bloop_customfont" style="margin:0px">
<div id="bloop_customfont" style="margin:0px"> Common errors can be:</div>
<div id="bloop_customfont" style="margin:0px"> * The SP’s web Server has set the X-Frame-Options to “sameorigin”, which will make the SLO response from SP to IdP fail.</div>
</div>
<div><br>
</div>
<div>The SP is indeed setting that header to "sameorigin".</div>
<div><br>
</div>
<div>The functionality of X-Frame-Options has been reduced in modern browsers so it needs to be fixed with CSP headers instead.</div>
<div><br>
</div>
<div>It will take awhile to actually test this, but so far it seems like a very likely cause of the problem.</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div><br>
</div>
<div>Pete</div>
<br>
<div id="bloop_sign_1774524256987660032" class="bloop_sign"><span style="font-family:'helvetica Neue',helvetica; font-size:14px">-- </span><br style="font-family:'helvetica Neue',helvetica; font-size:14px">
<span style="font-family:'helvetica Neue',helvetica; font-size:14px">Pete Birkinshaw</span><br style="font-family:'helvetica Neue',helvetica; font-size:14px">
</div>
<div id="bloop_sign_1774524256987660032" class="bloop_sign"><span style="font-family:'helvetica Neue',helvetica; font-size:14px"><br>
</span></div>
<div id="bloop_sign_1774524256987660032" class="bloop_sign"><span style="font-family:'helvetica Neue',helvetica; font-size:14px"><br>
</span></div>
<div class="airmail_ext_on" style="color:black">From: <span style="color:black">Scott Cantor via users</span>
<a href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
Reply: <span style="color:black">Shib Users</span> <a href="mailto:users@shibboleth.net">
<users@shibboleth.net></a><br>
Date: <span style="color:black">25 March 2026 at 14:55:26</span><br>
To: <span style="color:black">Shib Users</span> <a href="mailto:users@shibboleth.net">
<users@shibboleth.net></a><br>
Cc: <span style="color:black">Scott Cantor</span> <a href="mailto:scott@restingparrotsoftware.com">
<scott@restingparrotsoftware.com></a><br>
Subject: <span style="color:black"> Re: Logout propagation causes empty download <br>
</span></div>
<br>
<blockquote type="cite" class="clean_bq"><span>
<div>
<div></div>
<div><br>
<br>
> On Mar 25, 2026, at 9:28 AM, Pete Birkinshaw <pete@digitalidentitylabs.com> wrote:<br>
> <br>
> Has anyone else seen global logout on an IdP cause Safari to download an empty file?
<br>
<br>
OSU's IdP isn't exhibiting that from what I can see, but I'll have to make sure I'm testing with something that it would actually send a logout to, as that's very rare.<br>
<br>
Our propagation results UI is hidden (as it's not accessible), so it's possible that masks the behavior, but since the underlying iframes are hidden either way, I wouldn't think it would make a difference whether the Javascript signaling is visible or not.<br>
<br>
I would tend to think it's to do with the SP it's trying to send to more than anything else.<br>
<br>
-- Scott<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</div>
</span></blockquote>
</div>
</body>
</html>