Ticket mismatches

[matth]

Hi there,

Just wondering if there could be a separate URL for mismatched
tickets?

E.G. Some user tampers with the cookie, we'd like to know about it, so
we could put some logging on a special endpoint?

Cheers,

Matt

[Manuel Kasper]

On 02.08.2010, at 19:41, matth wrote:

> Just wondering if there could be a separate URL for mismatched
> tickets?
>
> E.G. Some user tampers with the cookie, we'd like to know about it, so
> we could put some logging on a special endpoint?

Sounds reasonable - I've added it to the to do/wishlist on <https://neon1.net/mod_auth_pubtkt/>. Shouldn't be too hard to add the next time I touch the Apache module source code :)

In the meantime, what you can also do is parse/verify the ticket yourself in your login server code to detect tickets with invalid signatures (but I see that you've implemented a matching Ruby library function, so I guess you're already doing that :).

- Manuel

[Matthew Haynes]

Thanks Manuel,

Yep the client library can verify the ticket too so it can be implemented that way.

Kudos for the module, it's so simple I'm not sure why there aren't loads more solutions like this. Makes such a difference delegating auth to Apache, especially when your running multiple webapps in various languages :)

Cheers,

Matt