Shibboleth Developers

["Cantor, Scott E." <>]

> As to when the session ID is generated, it's part of the initial
> negotiation.  One way to think about it is that all HTTP requests
> occur within a session.

As you suggested, however, there's a pretty good chance they'll occur in 
multiple sessions, not just one. I very much doubt you'll have any solid 
control over when they change.

I think it would make logout pretty much impossible to rely on (ok, more 
impossible), and would lead to a lot of client-specific weirdness.

In other words, I suspect most people would end up having to turn it off in 
favor of cookies, but we probably wouldn't know without testing it.
 
Of course, if you use client TLS, that's a perfect solution, but not 
generally relevant.

-- Scott