Update: SAML Security Cheat Sheet #1876
Description
What is missing or needs to be updated?
In the section discussing IdP Initiated SAML SSO, it says:
Unsolicited Response is inherently less secure by design due to the lack of CSRF protection.
And while the CSRF call out is fair, I think there is an issue with the article it links out to. It's main point is the following:
IdP-Initiated SSO is highly susceptible to Man-in-the-Middle attacks, where an attacker steals the SAML assertion
My point here: a MITM attack would be just as effective against an SP-Initiated login, since the attacker could just steal or edit the cookies that the SP would be using to tie a response to a session.
How should this be resolved?
Remove the reference to this article, and while we are here also change CSRF to login CSRF for clarity
My pitch is the following:
Unsolicited Response by design lacks login CSRF protection, since there is no step available for the SP to create a pre-login session.