search

SAML-Toolkits / python3-saml

MIT License
672 stars 302 forks source link

response_id is not validated if assertion doesn't have InResponseTo #278

Open m-novikov opened 2 years ago

m-novikov commented 2 years ago

If request_id is given and InResponseTo doesn't match error is raised But if request_id is given and InResponseTo is missing from the assertion body, then there is no reason. Excepted to have an error in second case also Kind of related to my previous issue #263

pitbulk commented 2 years ago

If you provide a request_id in order to validate the InResponseTo, but there is no InResponseTo, that means that meanwhile you generated the request, an IdP-initiated flow happened, that SAMLResponse is legit and it should not be invalidated by the request_id match, in my opinion.

m-novikov commented 2 years ago

It seems highly unlikely that this kind of concurrency happens in a user browser, and even if it is ,developer still has an option to distinguish between IdP and Sp initiated flows based on RelayState and adjust validation

Also for some applications IdP initiated flow is optional.

In my opinion it would be nicer for library to provide stricter validation that can be bypassed by developer in their app.

paulwouters commented 2 years ago

I agree with Maksim here. It would be nice to be strict by default.

neuroid commented 2 years ago

Ditto.

With the current logic, rejecting IdP-initiated SSO requires more work than it should.