src/main/edu/wisc/doit/FederatedPreauthUserDetailsProvider.php · 661a01b1bdc71bf55cc3cbd149b69b7faaf6d2ca · adi-ia / uw-php-security

8 years ago

Fix bug with non-HTTP Shib sessions being valid for HTTP sessions · f5aa2687

Andy Summers authored 8 years ago

Previously, the `PreauthUserDetailsProvider` was only checking that a
valid Shib session existed by looking for the regular or HTTP Shib
session header. This check is now strengthened by validating the
correct header exists for the correct instance.

f5aa2687

History

Fix bug with non-HTTP Shib sessions being valid for HTTP sessions

Andy Summers authored 8 years ago

Code owners

Assign users and groups as approvers for specific file changes. Learn more.