Shibboleth Developers

[Jim Fox <>]

On Thu, 1 Jul 2004, Scott Cantor wrote:

> However, I'd like to clarify something...I didn't think the attack Jim was
> concerned about involved one application obtaining another application's
> session key for a user, except in the case where it would then impersonate
> the user (which would require IP spoofing or disabling the IP check).

My concern was that the stolen session cookie could be used
to hijack the user's existing session.  If there is a client
ip address attached to the session then this is less of a 
concern.  We considered doing this with pubcookie sessions
but decided not to for a couple of reasons: first that the client
might change ip addresses during a sessions, second that clients
behind a firewall often have the same ip address anyway.

Jim