bozzltron / express-saml Goto Github PK
View Code? Open in Web Editor NEWSAML authentication support of node.js express framework
SAML authentication support of node.js express framework
Note the "+2": date.getUTCHours()+2
This means your timestamps are out of whack and invalid for two hour each day.
Just in case someone is using or considers using this library (or to copy paste code from this library)...
This library has every possible SAML related vulnerability that one could list starting from the fact that it does not validate authentication response signature which means that SW that uses this library / copy paste from this library is open for everyone in the internet. Everyone can scratch authentication response with any NameID and post it to SW that uses this library in order to have authenticated session (impersonate anyone).
I.e. code linked to the end of this issue does not have any security measurements listed e.g. in these documents:
And that code does not follow any processing rules (which are related to security) listed in these specifications (SAML core and SAML Web SSO profile related parts):
Lines 5 to 44 in 9c04343
Great work on adding SAML support to Node.js! I'm looking to adapt your approach to make a SAML strategy for the Passport authentication library.
I noticed there is no license information in your repository. Is the plan to have this under MIT like most Node.js code, or?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.