JSON dictionary in the Relay State parameter

[Brent Putman]

On 3/25/24 8:42 AM, Cantor, Scott via users wrote:
>> My intention in this discussion is not to be confrontational but to seek a shared
>> understanding of the SAML 2.0 specifications, especially regarding handling the
>> RelayState. According to the text from Errata E90:

I echo everything that Scott said. Without a signature over the 
RelayState data, such as by a binding-level signature, the data is 
subject to manipulation.  So that's the main threat. That's why sending 
non-opaque data like URLs or JSON is not wise.

But in terms of what I said earlier:  Yes, in my rush to answer, I did 
overlook the errata language which mentioned the possibility of URLs 
"derived from" the RelayState.  So obviously if the JSON data contained 
literal URL(s) (e.g as a key value etc), then those are subject to the 
requirements of the errata (RFC "MUST" and "MUST NOT").  And 
technically, yes, if there is arbitrary data there that later will be 
used in the production/generation/derivation of URLs, then that would 
be covered too, conceptually speaking. But note that, in the absence of 
actual plainly visible URLs, no one but the SP could possibly know how 
the data would be used for that purpose.

If you have questions or seek clarifications about the SAML spec 
itself, there is an OASIS list (saml-dev) specifically for questions 
like this:

https://saml.xml.org/mail-lists-and-forums

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240325/cc486548/attachment.htm>