feat: allow request uuid to be stored #174
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Jamedjo
force-pushed
the
jej/allow-storing-request-uuid
branch
from
250c64b
to
220d9be
Compare
Jamedjo
force-pushed
the
jej/allow-storing-request-uuid
branch
from
220d9be
to
cf08ad5
Compare
|
@md5 @supernova32 Does this look ok? |
suprnova32
previously approved these changes
Apr 17, 2019
There was a problem hiding this comment.
@Jamedjo the code looks good. Are you using this already in your apps?
bufferoverflow
previously approved these changes
May 5, 2019
Introduces a :store_request_uuid option for later comparison with InResponseTo By default it saves the request uuid in the session as "saml_transaction_id", but also accepts a proc that will then be called with the uuid for custom storage.
Jamedjo
force-pushed
the
jej/allow-storing-request-uuid
branch
from
cf08ad5
to
8ac901c
Compare
|
Was this ever solved in a different way? I see no updates here, and I was trying to do SP-initiated only log-in by looking at the InResponseTo, but I don't think that is currently possible, is it? Is there any recommendation to avoid CSFR otherwise? How do you recommend to go about this? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What
Introduces a :store_request_uuid option for later comparison with InResponseTo
By default it saves the request uuid in the session as "saml_transaction_id",
but also accepts a proc that will then be called with the uuid for custom storage.
Why
Needed for #172, although we may also want to pass the value to ruby-saml with
matches_request_id:.