[mitreid-connect] Suspicious behaviour when invalid redirect uri is detected?

[Luiz Omori]

I see, a bit tricky. The SSO scenario is even a bit scarier: let’s say the user is not logged in anywhere within MitreID domains and SSO partners. Even though the operation described below failed, not only the user behind the scenes is logged in to MitreID but also to all SSOs. I mean, I understand that deleting an existing session may be too drastic but creating a brand new one upon failure seems an unnecessary risk. Can’t it perform the redirect_url check before going all the way to the user log in?

Regards,
Luiz

From: Justin Richer <jricher at mit.edu>
Date: Friday, December 2, 2016 at 3:24 PM
To: Luiz Omori <luiz.omori at duke.edu>
Cc: "mitreid-connect at mit.edu" <mitreid-connect at mit.edu>
Subject: Re: [mitreid-connect] Suspicious behaviour when invalid redirect uri is detected?

This is expected but I understand it could be disconcerting. Your session to the IdP is not terminated on an error. Not only would that be an awful user experience in most cases, in some instances where the server is deployed in an SSO environment you *can’t* really kill the session anyway.

 — Justin

On Dec 1, 2016, at 11:32 AM, Luiz Omori <luiz.omori at duke.edu<mailto:luiz.omori at duke.edu>> wrote:

Hi,

Interesting thing happened this morning while testing an application. I was using the Implicit flow and put a redirect url that hadn’t been configured in the server yet. The proper error message was displayed but I’ve noticed that may name was displayed on the top-right corner and could access some features from the server as if I was logged in to it. Is this by expected? I was kind of expecting that upon error my login would be aborted.

Regards,
Luiz

(Pictures removed...)
_______________________________________________
mitreid-connect mailing list
mitreid-connect at mit.edu<mailto:mitreid-connect at mit.edu>
http://mailman.mit.edu/mailman/listinfo/mitreid-connect<https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_mitreid-2Dconnect&d=CwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=YoJA05euf5lY8uMCoYCMWH38IgMqk01jZ2ycHC6-GBw&s=BJSQi21OexyOoCNxbtU4fAtA1f844hO-dICE8Nc4s5c&e=>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/mitreid-connect/attachments/20161202/0b89642a/attachment-0001.html