SAML RelayState is state, not an authorization claim
SAML RelayState is state, not an authorization claim SAML bindings may include a RelayState value alongside the protocol message. Service providers commonly use it to resume a user's original request after an identity provider returns an assertion. The value is transport state. It should not become evidence that the user was authorized, and it should not be accepted as an arbitrary redirect…
The SAML RelayState is a piece of state information, not an authorization claim. It is commonly used by service providers to resume a user's original request after an identity provider returns an assertion. However, it should not be treated as evidence that the user was authorized or accepted as an arbitrary redirect target. To ensure safety, service providers should store the service-provider transaction on the server and provide the browser with an opaque, random handle.
This handle maps to the original request, the target tenant, the relay destination, and a short expiry. When the response returns, the handle should be validated, consumed once, and then continue with the saved context. Proper handling of the RelayState involves storing it securely on the server, using an allowlist of relative paths or known application origins, and implementing proper error handling to prevent leaking sensitive information.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
