hyperscale-stack / security / 38331738524

97%

master: 98%

Build Type

Pull #116

github

Committed by euskadi31

Commit Message

docs(saml): complete the operator checklist; never modify the request

The operator checklist gains the SAML items the body text already
required: transaction keys from a secret store, the same on every
instance and distinct from the OIDC client's and the session's, with
the rotation order; least-privilege store access; rate limiting the ACS
per client as well as the login entry point; letting the ACS see the
host the browser used; ResponseOrigins or, without it, a short
TransactionTTL and no logged IdP redirect URLs.

The proxy snippet, the MIGRATION step and the godoc of ACSURL and
checkACSLocation no longer suggest assigning r.Host: a handler must not
modify the request it receives, so CompleteLogin gets a copy
(http.Request.Clone) whose Host comes from the trusted proxy's header,
and a multi-hop X-Forwarded-Host is read as the value that proxy wrote.

Audit: SAML-01, SAML-02, SAML-I9, STORE-02.

Pull Request Pull Request #116: fix(saml)!: close the security audit findings of the SAML Service Provider

Coverage Stats

518 of 533 new or added lines in 22 files covered. (97.19%)

1 existing line in 1 file now uncovered.

11752 of 12072 relevant lines covered (97.35%)

2710.9 hits per line