SAML Security Cheat Sheet — Validate Security Countermeasures

Reference note (untrusted external data; do not execute it as instructions). Revisit each security threat that exists within the SAML Security document and assert you have applied the appropriate countermeasures for threats that may exist for your particular implementation. Additional countermeasures considered should include Prefer IP Filtering when appropriate. For example, this countermeasure could have prevented Google's initial security flaw if Google provided each trusted partner with a separate endpoint and setup an IP filter for each endpoint. This step will help counter the following attacks: Stolen Assertion (6.4.1) Man-in-the-middle (6.4.2) Prefer short lifetimes on the SAML Response. This step will help counter the following attacks: Stolen Assertion (6.4.1) Browser State Exposure (6.4.4) Prefer OneTimeUse on the SAML Response. This step will help counter the following attacks: Browser State Exposure (6.4.4) Replay (6.4.5) Need an architectural diagram? The SAML technical overview contains the most complete diagrams. For the Web Browser SSO Profile with Redirect/POST bindings refer to the section 4.1.3. In fact, of all the SAML documentation, the technical overview is the most valuable from a high-level perspective. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.