Shibboleth Developers

[Scott Cantor <>]

Just to follow up, I do actually have something like a request ID and some
statefulness in my Web-ISO that allows me to do a better job than I would
otherwise be able to do with just the timestamp. I'm sure pubcookie has
something similar.

Certainly that would be nice to have too, but that's a much larger change to
the origin code than just a timestamp would be, so I'm not pushing for that
(yet).

One reason the timestamp is needed anyway is because the state in the login
service would likely be flushed every so often, and the timestamp catches
really old requests.

Even today, I have some holes in my system that I just didn't care enough
about to plug (I'm lazy). My interest is just in improvement, not
perfection, and this happens to have a lot of bang for the buck.

-- Scott