Added checks for expired assertion

krakenjs / passport-saml-encrypted

A strategy for Passport authentication that supports encrypted SAML responses

MIT License

14 stars 26 forks source link

Added checks for expired assertion #8

Closed coffutt closed 9 years ago

coffutt commented 9 years ago

Current versions don't validate that the SAML assertion conditions for NotOnOrAfter are met. Without checking this parameter, apps are vulnerable to replay attacks where the user can save the SAML assertion and post it back to the app in the future without having to log in.

lmarkus commented 9 years ago

Published. Thanks!