The Core Misconception: Trusting the IdP Blindly
The most common mistake isn't a line of code; it's a mindset. Teams assume that because a SAML response comes from a trusted Identity Provider (IdP), the assertion is inherently safe. This is false. The protocol is only secure when the Service Provider (your
application) performs its own strict validation. The IdP's job is to authenticate the user; your app's job is to verify that the assertion it receives is valid, untampered, and intended for it. Thinking the IdP handles all security is like a bouncer letting someone into a club just because they said they're on the list, without actually checking the list.
The Signature Validation Gap
Here’s where things get technical and dangerous. SAML assertions are protected by XML signatures, but a 'valid signature' doesn't mean what many developers think. A common attack, known as XML Signature Wrapping (XSW), exploits a critical gap in logic. An attacker can take a valid, signed assertion, wrap it with their own malicious data, and submit it. Many applications check for a valid signature anywhere in the document, find the original, and approve it. Then, a separate part of the code extracts user data from the malicious section the attacker injected. The fix is to ensure your code only processes data from the exact same XML element that the signature was verified against.
Ignoring the Envelope's Address
A SAML assertion is like a letter containing a security pass. It has a 'To' address (the Audience field) and a postmark (the timestamp). Many implementations fail to check these properly. An attacker can take a valid assertion intended for 'Service A' and replay it to 'Service B' if Service B doesn't verify it's the intended audience. Likewise, failing to enforce tight expiration windows with the 'NotOnOrAfter' attribute allows an attacker to replay an old, intercepted assertion. These checks are not optional; they are fundamental to preventing replay attacks and ensuring an assertion is only used when and where it's supposed to be.
The Single Logout Nightmare
Single Sign-On (SSO) gets all the attention, but its counterpart, Single Log-Out (SLO), is notoriously difficult and often implemented insecurely, if at all. When a user logs out of one application, an SLO process should ideally terminate their session with the IdP and all other connected services. However, this is a fragile, multi-step process that can easily fail if a single service provider is unresponsive, leaving 'orphaned sessions' active. These lingering sessions are a security risk, as a user who thinks they've logged out everywhere may still be authenticated in some applications. Many platforms don't even fully support IdP-initiated logout, further complicating a unified security posture.
Accepting Unsigned Assertions
It sounds unbelievable, but a surprising number of systems are configured to accept SAML assertions that aren't even signed. This often happens in development or staging environments for convenience and is then forgotten when moving to production. In other cases, developers assume that since the communication is over a secure HTTPS channel, the signature is redundant. This is a critical error. An unsigned assertion is just a block of XML that anyone can create and modify. Accepting it is equivalent to letting someone bypass authentication entirely. Security policies should enforce that all SAML assertions must be signed by a trusted IdP, without exception.
