search

node-saml / passport-saml

SAML 2.0 authentication with Passport
MIT License
864 stars 474 forks source link

Suggestion about adding a validation logic for Recipient of SAML Response #509

Open akasakashota opened 3 years ago

akasakashota commented 3 years ago

According to some SAML specifications (4.1.4.3 in SAMLProf and 6.4.2 in SAMLSec), the specs says that a Service Provider MUST check the Recipient attribute of the SAML response. However, there doesn't seem to be any logic for validation in this library.

IMO, Audience validation may suffice in the majority of cases, but I think it is desirable to validate Recipient because there is a clear difference in the specifications between them.

cjbarth commented 3 years ago

@akasakashota , please provide a PR to accomplish this.