A SAML service provider should verify the signature with an identity provider key it obtained out of band, then check Destination, Audience, Recipient, InResponseTo, replay and validity times. Skipping any of these has produced real sign-in bypasses. Prefer a maintained library, and test that it performs each check.
Signature checks
OWASP's SAML Security Cheat Sheet says to trust only identity provider keys you got out of band and to ignore any KeyInfo inside the document. Reject SHA-1 and require at least RSA-SHA-256. Confirm the signature reference resolves to the assertion you actually use to log the person in.
Defend against signature wrapping
Attackers move or duplicate elements so the signed part is valid but the part your code reads is not. OWASP recommends:
- Schema-validate the XML before any security processing, using local trusted schemas.
- Never select security elements by tag name without validation first.
- Use absolute XPath for security elements.
- Reject assertions outside the validated signed content.
Binding the response to you
- Destination must exactly match your Assertion Consumer Service URL. Reject missing or mismatched values.
- Audience must match your service provider entity ID.
- Recipient in the subject confirmation must match your ACS URL.
- InResponseTo must match the ID of the request you sent. OWASP cites a missing check of this kind in an SSO bug affecting a large provider.
Replay and time
For identity-provider-initiated sign-in there is no request to match, so add replay detection at the response or assertion level, and prefer OneTimeUse. Do not cache SAML protocol messages. Validate both NotBefore and NotOnOrAfter, prefer short lifetimes, and keep clocks in sync.
Certificates
Fetch identity provider certificates from a metadata URL over TLS, not by email. OWASP suggests RSA 2048 or ECC 256 minimum, separate certificates for signing and encryption, revocation checks where supported, and rotation planned before expiry.
Test checklist
- Alter one signed value and confirm rejection.
- Replay a captured response and confirm rejection.
- Send a response for a different audience.
- Send an expired assertion.
- Check how your library behaves with unsigned assertions inside signed responses.
OWASP notes that many libraries lack revocation checking and that algorithm support varies, so check your own.
Related
For plain-language background, see what is SAML and SAML vs OIDC.
Make these checks part of your integration tests rather than a one time review. Keep a small set of captured and tampered responses in your test suite, one per failure mode above, and run them in CI whenever you upgrade the library. Libraries change behaviour between versions, and a silent regression in signature or audience handling is exactly the kind of fault that only shows up when someone attacks you.
Quick check
Is a valid signature enough?
No. A validly signed response meant for another service, or an old one, must still be rejected.
Should we write our own SAML parser?
Use a maintained library and test it against the checks above.
Sources
Last reviewed: 19 October 2026.
