{
  "id": 17590237,
  "title": "SAML RelayState is state, not an authorization claim",
  "url": "https://urgent.news/2026/11/01/saml-relaystate-is-state-not-an-authorization-claim",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T11:41:54.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/johnettagaweraks/saml-relaystate-is-state-not-an-authorization-claim-d4j"
  },
  "original_language": "en",
  "account": null,
  "summary": "The SAML RelayState is a piece of state information, not an authorization claim. It is commonly used by service providers to resume a user's original request after an identity provider returns an assertion. However, it should not be treated as evidence that the user was authorized or accepted as an arbitrary redirect target. To ensure safety, service providers should store the service-provider transaction on the server and provide the browser with an opaque, random handle. This handle maps to the original request, the target tenant, the relay destination, and a short expiry. When the response returns, the handle should be validated, consumed once, and then continue with the saved context. Proper handling of the RelayState involves storing it securely on the server, using an allowlist of relative paths or known application origins, and implementing proper error handling to prevent leaking sensitive information.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}