RE: [saml-dev] common domain cookie

[Thomas Wisniewski <Thomas.Wisniewski@entrust.com>]

Scott, if we didn't b64 encode it then I assume we would change it to at
least be url-encoded.

Tom.

-----Original Message-----
From: Scott Cantor [mailto:cantor.2@osu.edu]
Sent: Monday, November 15, 2004 10:39 AM
To: 'Conor P. Cahill'; 'Tom Scavo'
Cc: saml-dev@lists.oasis-open.org
Subject: RE: [saml-dev] common domain cookie


> We (Liberty) had alot of early interoperability problems with cookies
> because of different versions of the Set-Cookie specs and brower
> limitations, so I presume this is an attempt to make it much less
> likely to cause a problem.

I think it may be more of a historical error on my part. When I "copied" the
profile into SAML, I made a change suggested by interop testers that we
would just put the IdP entityID in the cookie instead of a hash. The hash
was base64-encoded, and I think I copied the text without really thinking
about it.

It certainly works as is, but we could consider correcting it.

-- Scott