Shibboleth Developers

[Peter Schober <>]

* Lukas Haemmerle 
<>
 [2010-08-06 15:48]:
> So, do you think will it be enabled in the default config?

As Scott mentioned, signing outgoing requests exposes the SP itself to
trivial DoS attacks because every unauthenticated HTTP request will
result in a signing operation on the SP (and SPs usually don't have
HSMs).
So the safe choice is probably to default both to off (no signing of
requests on the SP, no skipping of ACS URL checking even for signed
requests on the IdP).
-peter