simplesamlphp / simplesamlphp/saml2
Incorrect HTTP Redirect binding signature
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 306
- Forks
- 138
- PR merge metrics
- No merged PRs in 30d
Description
The signature of the HTTP Redirect binding appears to be incorrect since this commit: https://github.com/simplesamlphp/saml2/commit/7b785a83a552e225c34adc84040a9268bbc3d4dd#diff-6a2c4640d940f28e0b49947ffbafd6d2726f92c9fba5fdad8202234083daff57
The signature is now set to the value of signature in the AuthnRequest, but (please correct me if I'm wrong) the signature should be based on the combined query parameters (As it was before the above commit)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing commit 7b785a83a552e225c34adc84040a9268bbc3d4dd and the HTTP Redirect binding signature implementation, then compare the signature input with the SAML binding requirements. Done means the implementation signs the correct combined query parameters and a regression check demonstrates the corrected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100