Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm implementing a SAML2 Service provider that will be running on a public facing web site. The sign in functionality is publicly available, so anyone can get hold of a AuthnRequest from my site.

When I do receive a response from the Idp, do I have to validate the InResponseTo field to make sure that the response is to a AuthnRequest I've issued or can I ignore it?

I don't understand how it would add any extra security when I'm already validating the signature of the response and have a replay protection by only allowing each assertion id to be used once within the validity time of the assertion (as specified by the condition).

share|improve this question
up vote 0 down vote accepted

It is explained in Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0 section 6.1.3 Message Insertion.

It is primarily a method for blocking fabricated requests inserted into the communication. As a complement to signing and/or SSL. It is not solving a separate security issue but is an in depth defense.

My interpretation is that checking InResponseTo is cheaper than validating the signature and a faster way to ditch invalid messages to avoid DOS attacks.

share|improve this answer

Yes, according to the SAML spec this must be validated.

I'm not 100% sure of the reason or this. But just thinking out loud. With the contraint on time and sigature, you would still be able to do a replay of the message within the validity time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.