Respect transformationAlgorithms in signed LogoutRequest (#301)

tngan · Aug 10, 2019 · 46ce077 · 46ce077
1 parent a15b6d7
commit 46ce077
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/binding-post.ts b/src/binding-post.ts
@@ -239,14 +239,15 @@ function base64LogoutRequest(user, referenceTagXPath, entity, customTagReplaceme
     }
     if (entity.target.entitySetting.wantLogoutRequestSigned) {
       // Need to embeded XML signature
-      const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm } = initSetting;
+      const { privateKey, privateKeyPass, requestSignatureAlgorithm: signatureAlgorithm, transformationAlgorithms  } = initSetting;
       return {
         id,
         context: libsaml.constructSAMLSignature({
           referenceTagXPath,
           privateKey,
           privateKeyPass,
           signatureAlgorithm,
+          transformationAlgorithms,
           rawSamlMessage: rawSamlRequest,
           signingCert: metadata.init.getX509Certificate('signing'),
           signatureConfig: initSetting.signatureConfig || {

diff --git a/src/libsaml.ts b/src/libsaml.ts
@@ -617,7 +617,7 @@ const libSaml = () => {
       if (!validate) {
 
         // otherwise, an error will be thrown
-        return Promise.reject('Your application is potentially vulnerable because there is no validation function is found. Please read the documentation on how to setup the validator. (https://samlify.js.org/#/schema-validator)');
+        return Promise.reject('Your application is potentially vulnerable because no validation function found. Please read the documentation on how to setup the validator. (https://github.com/tngan/samlify#installation)');
 
       }