Skip to content

need use relaystate to resolve csrf when integrate saml2 #9796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
javasingle opened this issue May 25, 2021 · 2 comments
Closed

need use relaystate to resolve csrf when integrate saml2 #9796

javasingle opened this issue May 25, 2021 · 2 comments
Labels
status: waiting-for-feedback We need additional information before we can continue

Comments

@javasingle
Copy link

javasingle commented May 25, 2021

Some documents suggest using relaystate to pass csrftoken to solve CSRF attacks. Some documents suggest using relaystate as the callback address of successful login. When I use spring loyalty, I didn't find the processing of relaystate。
when i integrate saml2 with my sp , need resolve csrf?

@javasingle javasingle added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels May 25, 2021
@sjohnr
Copy link
Contributor

sjohnr commented May 25, 2021

Hi @javasingle. It's not clear to me what you're asking. If you have a question or need help with a particular technical challenge, you will want to ask over on stackoverflow. If you are reporting a bug or requesting an enhancement, please use the issue template provided by GitHub when you click the New issue button, and also provide a minimal, reproducible sample to help illustrate your finding or request.

@sjohnr sjohnr added status: waiting-for-feedback We need additional information before we can continue and removed status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels May 25, 2021
@jzheaux
Copy link
Contributor

jzheaux commented May 26, 2021

Spring Security's SAML 2.0 support does not yet verify the RelayState parameter in a SAML 2.0 authentication response. To achieve this, we need #9185.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-feedback We need additional information before we can continue
Projects
None yet
Development

No branches or pull requests

3 participants