Comments (2)
srd90
commented on July 17, 2024
3
FWIW: If you experienced this issue today it means that you updated from passport-saml 2.x or earlier to 4.0.4 (because issue that you reported surfaced at version 3.x).
Beaware that passport-saml versions < 3.2.2 (and certain 4.x versions) had this authentication bypass vulnerability:
Which was actually vulnerability at one of the dependencies:
from passport-saml.
srd90
commented on July 17, 2024
1
This is duplicate of:
Issue was addressed at PR which was released at version 5.0.0 (link points to comment that discusses about which way it could be fixed):
Also related issue (about path parameter):
Eitherway passport-saml (actually node-saml at the heart of passport-saml) is not in the business of building URLs anymore as maintainer of the project states at the comment #909 (comment)
from passport-saml.
Related Issues (20)
- [BUG] Invalid document signature after upgrading from 2.2.0 to 4.0.1 HOT 12
- [BUG] Passport SAML is always chosen first by NestJS Passport, no matter the order HOT 1
- Invalid Signature While integrating passport-saml with OAM HOT 7
- [BUG] After an upgrade from passport-saml to @node-saml/passport-saml, assertion validation stopped working with HTTP-POST binding with an error: SAML.validatePostResponseAsync, Invalid document signature HOT 9
- Is there a way to test a provider configuration before call done() on MultiSamlStrategy? HOT 1
- Cannot POST /saml/consume HOT 3
- Possible to add custom relay state in SAML login requests? HOT 2
- Assertion signature is missing in SAML Response when using Google Workspace HOT 5
- [BUG] Invalid document signature HOT 7
- Functionality difference between Redhat UBI 8and UBI 9 HOT 3
- Reference id not matching with documentElement id HOT 8
- passport-saml requires session support (session auth) — Is it possible to do with JWT auth instead?
- [BUG] Bug in the implementation of MultiSamlStrategy on NestJS HOT 2
- [BUG] validateInResponseTo = true does not validate responses HOT 6
- Importing passport-saml fails on node v20.6.0 HOT 3
- [BUG] Importing @node-saml/passport-saml gives type error HOT 5
- [BUG] Error: Invalid document signature HOT 2
- Breaking change in v5.0.0, docs not updated (TypeError: callbackUrl is required) HOT 10
- [BUG] TypeError: expirationTimer.unref is not a function HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from passport-saml.