fix: duplicate URL Encode on RelayState

[coelho]

The RelayState is URL Encoded twice when using urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST.

• This is because Form Data is by default already URL Encoded.
• Additionally, for HTTP-Redirect, the RelayState is already Query Escaped: https://github.com/zitadel/saml/blob/main/pkg/provider/redirect.go#L120

This bug results in the ACS receiving the incorrect RelayState. This PR fixes the issue.

[mffap]

thanks for the PR @coelho
@stebenz can you have a look pls?

[stebenz]

The RelayState is URL Encoded twice when using urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST.

• This is because Form Data is by default already URL Encoded.
• Additionally, for HTTP-Redirect, the RelayState is already Query Escaped: https://github.com/zitadel/saml/blob/main/pkg/provider/redirect.go#L120

This bug results in the ACS receiving the incorrect RelayState. This PR fixes the issue.

Thank you for your contribution, it seems as if I totally overlooked this as it worked with crewjam and other SPs.

[codecov]

Codecov Report

Merging #29 (f171742) into main (fbd6044) will not change coverage.
The diff coverage is 50.00%.

@@           Coverage Diff           @@
##             main      #29   +/-   ##
=======================================
  Coverage   47.38%   47.38%           
=======================================
  Files          21       21           
  Lines        1967     1967           
=======================================
  Hits          932      932           
  Misses        977      977           
  Partials       58       58           

Impacted Files	Coverage Δ
pkg/provider/logout_response.go	0.00% <0.00%> (ø)
pkg/provider/response.go	61.34% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[github-actions]

🎉 This PR is included in version 0.0.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀