JSON dictionary in the Relay State parameter

[Brent Putman]

On 3/24/24 12:32 AM, Florian Lengyel via users wrote:
>
> In the SAML 2.0 Errata 05, the guidelines regarding RelayState 
> sanitization are presented as requirements, not just recommendations. 
> Implementations must carefully sanitize the URL schemes they permit, 
> specifically restricting them to "http" or "https" and must disallow 
> unencoded characters that could lead to security attacks
>
> Have these requirements been relaxed to recommendations?
>

No, Errata 05 is still the latest.  However, I believe what you are 
referring to in E90 there doesn't actually apply in your case of a JSON 
value.  It only addresses the case where the RelayState value is a URL 
(which is somewhat common in the real world). Essentially, IF it is a 
URL, THEN it must have an http or https scheme only and be encoded 
appropriately to address XSS, CSRF and other attacks, etc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240324/43bde077/attachment.htm>