Shibboleth Developers

[Scott Cantor <>]

> Well, the current profiles don't specify how the browser gets from the
> target to the "inter-site transfer service", so seems like it 
> would, or could.

This is true, but Liberty actually does specify a 302. There's been talk
about looking at whether another status code might be more accurate, but
probably the overall rules should be relaxed.

BTW, I don't know how relevant the meta-refresh is to this anyway. A
redirect also doesn't populate the history list, normally. The real "trick"
is the use of the cookie to carry the rquest, which allows the app to clear
it such that the Back button invocation looks different to the login URL
without it actually being a different URL.

-- Scott