One Login Spring SAML CRSF

0
votes

I am using the Spring Saml solution to protect my rest api running on tomcat.

I am using spring-security-saml2-core 1.0.2.RELEASE with Spring security 4.1.1.RELEASE.

I have created a Onelogin test connector/app. If I attempt to access http://localhost:8080/app-name/api/getstate I correctly get redirected to Onelogin and can authenticate. I am then redirected to http://localhost:8080/app-name/saml/SSO/alias/defaultAlias.

Problem :: I get "Could not verify the provided CSRF token because your session was not found." after the redirect

This is that as per Spring SAML Extension and Spring Security CSRF Protection Conflict.

The solution offered by Vladimír Schäfer suggests that CSRF should be disabled in the securityContext for the SAML endpoints.

This works but as I am new to spring security and spring security in general, I have to related queries :

  • Is it secure/best pracitice to turn off CSRF on the rest api in this scenario for Spring SAML URLs?

  • Is there a way for Onelogin to work with Spring Saml if CSRF enabled in spring security?

1
securityspring-securityspring-samlonelogin

1 Answers

4
votes

I'm not a Spring expert but I think I can solve your doubts.

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

SAML has its own mechanism to prevent unwanted actions, for example, on the endpoints require signed SAML Message in order to validate them (only legitimate sources will be able to sign the SAML message properly, so we avoid impersonations/message modifications).

So based on that I think is correct to disable CSRF protection on the following SP endpoints:

  • ACS. Assertion Consumer Service
  • SLS. Single Logout Service

On initiate SP-initiated SSO or SP-initiated SLO endpoints, I think is ok to maintain the CSRF protection.

Related to the other question, I think the unique way is to save at spring a state with the CSRF value, pass a way to recover the state as the RelayState parameter. Onelogin will send back the relayState Parameter in addition to the SAMLResponse and you will be able to recover your state, recover the CSRF and avoid the CSRF token error.