-
Notifications
You must be signed in to change notification settings - Fork 135
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect HTTP Redirect binding signature #345
Comments
You are absolutely right that the signature should be calculated over the message + some (not all) parameters. There is also more wrong about this code, because we're actually not signing anything.. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The signature of the HTTP Redirect binding appears to be incorrect since this commit: 7b785a8#diff-6a2c4640d940f28e0b49947ffbafd6d2726f92c9fba5fdad8202234083daff57
The signature is now set to the value of signature in the AuthnRequest, but (please correct me if I'm wrong) the signature should be based on the combined query parameters (As it was before the above commit)
The text was updated successfully, but these errors were encountered: