I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?

Details: I have worked with OAuth2 in the past, but I am not familiar with SAML concepts. With OAuth2, the JavaScript SPA can go directly at the Identity Provider and get a token. I can send this token to my RESTful server. The server only needs to be able to decode the token and verify that it is coming from a trusted provider.

  • Does SAML work in a similar way? Is there a simple reference that shows the workflow?
  • Is there a solution that works with my architecture - JavaScript SPA and Node.js serving a RESTful API?
  • Were you able to find a solution for this? Jan 18, 2018 at 17:31
  • were you ever able to get this to work? if so can you share your soln? I've asked a similar question here stackoverflow.com/q/53603554/358574 Dec 6, 2018 at 18:43
  • Nope. The need went away after a while!
    – Naresh
    Dec 6, 2018 at 22:03

1 Answer 1


For the record: In a typical SAML WebSSO flow the IDP wants to take control of the browser to establish or resume a session with the browser. So this approach needs to be tested if it is compatible with your IDP(s). There is another, less popular flow called ECP (Enhanced Client or Proxy) that should be more suitable.

See also: https://www.codeproject.com/Articles/1248145/How-to-use-SAML-in-an-Angular-JS-Single-Page-Appli

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .