<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
My intention in this discussion is not to be confrontational but to seek a shared understanding of the SAML 2.0 specifications, especially regarding handling the RelayState. According to the text from Errata E90: </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
4.1.6 Use of Relay State</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The RelayState feature of the various HTTP-based bindings defined for use with this profile MAY be used to preserve information about resources requested by the user agent prior to the use of the profile. As discussed in [SAMLBind], the lack of integrity protection
in many scenarios, including the case of unsolicited responses, makes it **essential for identity and service providers to perform appropriate sanitization of the RelayState value and any URLs derived from it.** The URL scheme eventually derived SHOULD be
limited to "https" or "http", and protection against unencoded executable content must be applied.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Section 4.1.6 indicates the necessity of sanitizing the RelayState value before deriving a URL. The implication is that a RelayState, while initially not a URL, can influence the creation or decision of one.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
In the case of the two service providers we are discussing, the data passed through RelayState, a JSON dictionary and not a traditional URL, eventually dictates the navigation, necessitating prior sanitization. This interpretation aligns with the broader security
principles that protect systems and users from potential vulnerabilities.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Florian Lengyel</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>From:</b> Florian Lengyel <Florian.Lengyel@cuny.edu><br>
<b>Sent:</b> Sunday, March 24, 2024 6:25 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net></div>
<div class="elementToProof" style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>Cc:</b> Brent Putman <putmanb@georgetown.edu></div>
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>Subject:</b> Re: JSON dictionary in the Relay State parameter</div>
<div style="direction: ltr;"> </div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The interpretation provided in your message that E90 only applies when the RelayState value is a URL is indeed not entirely accurate according to the text from the SAML 2.0 Errata E90. The errata do emphasize concerns around URLs because they're common and
high-risk vectors for attacks such as XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery), but the caution is broader.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Here's a breakdown:</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
1. Sanitization and Security Concerns: The errata indicates that there's a need for careful sanitization due to the lack of "end-to-end origin authentication or integrity protection of the RelayState value." This concern applies broadly to the handling of RelayState,
not exclusively to situations where RelayState is a URL.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2. Implementation Guidance: The guidance to "carefully sanitize the URL schemes they permit" and "disallow unencoded characters that may be used in mounting such attacks" suggests a focus on URLs, but the underlying principle is to prevent the RelayState from
being exploited for attacks. This principle should apply to any content within RelayState that could be manipulated for malicious purposes.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
3. URL-Specific Advice: While the text emphasizes URL schemes (restricting them to "http" or "https") and the prevention of executable content, the broader context of these guidelines is the prevention of XSS and CSRF attacks. This does not exclude other forms
of data from being a concern if they can similarly be exploited due to improper handling or lack of sanitization.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
4. Broader Application: The mention that "implementations MUST carefully sanitize...and should disallow unencoded characters" indicates a broader requirement than just for URLs. It suggests that any data within the RelayState should be handled in a way that
prevents malicious exploitation, which would include ensuring that JSON structures or other data forms don't contain harmful content.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
The intention is that all data, including but not limited to URLs, passed in the RelayState should be sanitized and secured against common web vulnerabilities. The errata's references to URL schemes and encoding primarily address the most common risks but do
not limit the scope of sanitization to URLs alone.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Therefore, asserting that the standard's requirements for sanitizing RelayState apply only to URLs and not to other data formats like JSON is misinterpretation of the errata. It's critical for all transmitted data, regardless of format, to be secured against
potential web-based vulnerabilities, especially in authentication flows.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="direction: ltr; display: inline-block; width: 98%;">
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>From:</b> users <users-bounces@shibboleth.net> on behalf of Brent Putman via users <users@shibboleth.net><br>
<b>Sent:</b> Sunday, March 24, 2024 3:26 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Brent Putman <putmanb@georgetown.edu><br>
<b>Subject:</b> Re: JSON dictionary in the Relay State parameter</div>
<div style="direction: ltr;"> </div>
<div style="background-color: rgb(255, 252, 213); margin: 2em; border-width: 1px; border-style: solid; border-color: initial;">
<p style="direction: ltr; text-align: center; margin-top: 0px; margin-bottom: 0px; padding: 1em;">
<b>* This email originates from a sender outside of CUNY. Verify the sender before replying or clicking on links and attachments. *</b></p>
</div>
<p style="direction: ltr; margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<div style="direction: ltr;">On 3/24/24 12:32 AM, Florian Lengyel via users wrote:</div>
<blockquote>
<div style="direction: ltr;"><br>
</div>
<p style="direction: ltr; margin-top: 0px; margin-bottom: 0px;">In the SAML 2.0 Errata 05, the guidelines regarding RelayState sanitization are presented as requirements, not just recommendations. Implementations must carefully sanitize the URL schemes they
permit, specifically restricting them to "http" or "https" and must disallow unencoded characters that could lead to security attacks </p>
<div style="direction: ltr;">Have these requirements been relaxed to recommendations?</div>
<div style="direction: ltr;"><br>
</div>
</blockquote>
<p style="direction: ltr; margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p class="elementToProof" style="direction: ltr; margin-top: 0px; margin-bottom: 0px;">
No, Errata 05 is still the latest. However, I believe what you are referring to in E90 there doesn't actually apply in your case of a JSON value. It only addresses the case where the RelayState value is a URL (which is somewhat common in the real world).
Essentially, IF it is a URL, THEN it must have an http or https scheme only and be encoded appropriately to address XSS, CSRF and other attacks, etc. </p>
</body>
</html>