[mitreid-connect] Suspicious behaviour when invalid redirect uri is detected?

[Justin Richer]

All depends on where in the stack you configure the user login. Most of the time, the SSO check happens very early on, though, long before the application code kicks in. The idea is that you shouldn’t even bother processing the request if you don’t know who the user is.

 — Justin

> On Dec 2, 2016, at 3:41 PM, Luiz Omori <luiz.omori at duke.edu> wrote:
> 
> I see, a bit tricky. The SSO scenario is even a bit scarier: let’s say the user is not logged in anywhere within MitreID domains and SSO partners. Even though the operation described below failed, not only the user behind the scenes is logged in to MitreID but also to all SSOs. I mean, I understand that deleting an existing session may be too drastic but creating a brand new one upon failure seems an unnecessary risk. Can’t it perform the redirect_url check before going all the way to the user log in?
>  
> Regards,
> Luiz
>  
> From: Justin Richer <jricher at mit.edu>
> Date: Friday, December 2, 2016 at 3:24 PM
> To: Luiz Omori <luiz.omori at duke.edu>
> Cc: "mitreid-connect at mit.edu" <mitreid-connect at mit.edu>
> Subject: Re: [mitreid-connect] Suspicious behaviour when invalid redirect uri is detected?
>  
> This is expected but I understand it could be disconcerting. Your session to the IdP is not terminated on an error. Not only would that be an awful user experience in most cases, in some instances where the server is deployed in an SSO environment you *can’t* really kill the session anyway. 
>  
>  — Justin
>  
> On Dec 1, 2016, at 11:32 AM, Luiz Omori <luiz.omori at duke.edu <mailto:luiz.omori at duke.edu>> wrote:
>  
> Hi,
>  
> Interesting thing happened this morning while testing an application. I was using the Implicit flow and put a redirect url that hadn’t been configured in the server yet. The proper error message was displayed but I’ve noticed that may name was displayed on the top-right corner and could access some features from the server as if I was logged in to it. Is this by expected? I was kind of expecting that upon error my login would be aborted.
>  
> Regards,
> Luiz
>  
> (Pictures removed...)
> _______________________________________________
> mitreid-connect mailing list
> mitreid-connect at mit.edu <mailto:mitreid-connect at mit.edu>
> http://mailman.mit.edu/mailman/listinfo/mitreid-connect <https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_mitreid-2Dconnect&d=CwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=YoJA05euf5lY8uMCoYCMWH38IgMqk01jZ2ycHC6-GBw&s=BJSQi21OexyOoCNxbtU4fAtA1f844hO-dICE8Nc4s5c&e=>
>  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/mitreid-connect/attachments/20161202/ee97c3a2/attachment.html