fix(saml): validate responses against AuthnRequest#1794
Conversation
nijel
commented
Jun 17, 2026
nijel
commented
- Store generated AuthnRequest IDs per IdP and pass them into python3-saml response validation.
- Reject authenticated account-association callbacks without a matching InResponseTo while preserving anonymous IdP-initiated SSO.
- Revalidate restored-session callbacks after session restore so request IDs stored in the restored session are enforced.
- Add regression tests for missing, mismatched, matching, anonymous, and restored-session SAML response paths.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1794 +/- ##
==========================================
+ Coverage 83.96% 84.23% +0.26%
==========================================
Files 341 341
Lines 12155 12499 +344
Branches 579 597 +18
==========================================
+ Hits 10206 10528 +322
- Misses 1742 1756 +14
- Partials 207 215 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 98f353d0d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
nijel
force-pushed
the
saml
branch
2 times, most recently
from
7c2d567 to
153b6af
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 153b6afa45
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c790f27ef2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c31de88349
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 711789c45b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Store generated AuthnRequest IDs per IdP and pass them into python3-saml response validation. - Reject authenticated account-association callbacks without a matching InResponseTo while preserving anonymous IdP-initiated SSO. - Revalidate restored-session callbacks after session restore so request IDs stored in the restored session are enforced. - Add regression tests for missing, mismatched, matching, anonymous, and restored-session SAML response paths.
1 participant
