Shibboleth Developers

["Scott Cantor" <>]

> No, the threat I worry about is cookie theft, which is much easier.
Browsers
> don't do a good job of protecting against that, bugs there crop up
> constantly. An IP check is an order of magnitude harder to beat than
> exploiting the bug of the week in IE is.

I should point out that this is more of a consequence of implementation than
anything else. I could have (and maybe I should) split the settings up so
that you could disable the IdP vs SP address check during initial sign on
but still lock the session cookie down to one address.

I equated them because in my experience it's not an IdP vs SP problem but
more of a problem with a user behind a proxy that's changing the address all
the time, so when we've had to disable it, it's been for both purposes.

Sounds like your scenario of local campus NAT might justify splitting them
up for the next version.

-- Scott