SP encodes protocol in IDP URL when using HTTP-POST binding
Basics
Technical
Logistics
Basics
Technical
Logistics
Description
When the SP is configured to use HTTP-POST binding to forward a client to the IDP, the URL in the html form action contains an encoded ":" within the protocol. For example:
That's part of the logic that protects against XSS. I'm not about to remove it or alter that, but I'll consider an option to control which characters are encoded for people that want to assume the risk themselves.
Fixed
Pinned fields
Click on the next to a field label to start pinning.
When the SP is configured to use HTTP-POST binding to forward a client to the IDP, the URL in the html form action contains an encoded ":" within the protocol. For example:
<form method="POST" action="https://idp.example.org/idp/profile/SAML2/POST/SSO">
The colon character should not be encoded in URLs when it is used as part of the protocol.
Browsers appear to handle this ok, however we have application proxies which do not.