idp3 "Message was expired" and http status code 500

[Jarno Huuskonen]

On Fri, Sep 04, Jarno Huuskonen wrote:
> Is it "normal" for idp3 (3.1.2) to reply with http error/status code 500
> (internal server error) when client sends expired saml message.
> (I'm using tomcat if that makes a difference).
> 
> Idp logs this expired message:
> "Message was expired: message issue time was '2015-08-30T01:02:40.000Z',
> message expired at: '2015-08-30T01:08:40.000Z', current time:
> '2015-09-04T08:34:07.121+03:00'"
> 
> and http access_log:
> ip.add.re.ss - - [04/Sep/2015:08:38:16 +0300] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFRT4MwFI_REST_OF_SAML_REMOVED HTTP/1.1" 500 1332

Also replayed messages seem to get 500 status code:
WARN [org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler:155] - JSESSIONID=..removed.. - Message Handler:  Replay detected of message...

ip.add.re.ss - - [04/Sep/2015:10:55:07 +0300] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFdT_rest_removed_ HTTP/1.1" 500 684

IMHO in both cases status code 400 or 403 would be better.

-Jarno

-- 
Jarno Huuskonen