CODEWITHSUNDEEP
securitysingle-sign-onsamlsaml-2.0
Shatiz
Shatiz

Reputation: 817

How to prevent replay attack in IDP initiated SSO using SAML2

In IDP initiated SSO, SAML response from IDP could be prone to replay attacks. Since SP has no awareness about the IDP initiated session till it gets the response, what are the possible ways to protect replay attack?

Upvotes: 0

Views: 2873

Answers (1)

Anders Abel
Anders Abel

Reputation: 69250

The SP should keep a list of IDs of accepted assertions, for the lifetime of the assertion to prevent Replay.

And re the ID change - that's not possible with a properly signed assertion/response. Nothing can be altered by a man-in-the-middle. If altering is possible, you have WAY bigger problems than just replay.

Upvotes: 4

Related Questions