- Issue created by @mingsong
- 🇳🇱Netherlands roderik Amsterdam,NL / Budapest,HU
I guess this isn't implement in the PHP-SAML module because it needs a cache backend.
I guess what this needs is a cache backend to keep all IDs(?) of OneTimeUse, for a configurable period of time. It should probably be a "normal" cache bin so site administrators can make the cache permanent if they want by e.g. installing + configuring pcb → .
I was wondering why this doesn't get more attention on the internet than it does. Probably that's because, if HTTPS is used for communication with the IdP and the IdP is configured to common standards (i.e. only answer to requests from known certificates), it isn't that easy to steal SAML requests / assertions.
(Maybe on a public computer that has a special browser extension installed to snoop and save those assertions...)