<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 3/24/24 12:32 AM, Florian Lengyel
via users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:MW5PR14MB5387458811C4EC260643F3888E372@MW5PR14MB5387.namprd14.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div id="mail-editor-reference-message-container" dir="auto">
<div dir="auto">
<div id="mail-editor-reference-message-container" dir="auto"><br>
<div dir="auto">
<p>In the SAML 2.0 Errata 05, the guidelines regarding
RelayState sanitization are presented as requirements,
not just recommendations. Implementations must carefully
sanitize the URL schemes they permit, specifically
restricting them to "http" or "https" and must disallow
unencoded characters that could lead to security
attacks </p>
<div dir="auto">Have these requirements been relaxed to
recommendations?</div>
</div>
</div>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>No, Errata 05 is still the latest. However, I believe what you
are referring to in E90 there doesn't actually apply in your case
of a JSON value. It only addresses the case where the RelayState
value is a URL (which is somewhat common in the real world).
Essentially, IF it is a URL, THEN it must have an http or https
scheme only and be encoded appropriately to address XSS, CSRF and
other attacks, etc. <br>
</p>
</body>
</html>