encrypted SAML token

Question

I am using the php-saml toolkit https://github.com/onelogin/php-saml to implement an SSO in a web application. The authentication in itself works but when i check with an intercepting proxy https://portswigger.net/burp/communitydownload the saml token appears in clear (as xml, with the username along with all information passed for authentication). In the connector and the setting https://github.com/onelogin/php-saml/blob/master/settings_example.php i have set the certificate (in idp/x509cert)

I am not sure if the presence of the certFingerprint makes a difference, i tried with and without and the saml token is in clear in both cases.

Is it possible to have this saml response encrypted ? it is still signed so it cannot be changed but having this data in clear is still a problem for me

Answer 1

You can indeed have the SAML response encrypted, and it will need to be setup by your Onelogin administrator for your application. Encrypting the Response ( or the Assertion ) is mitigated by using TLS as you're already encrypted at the transport layer, and most applications I see don't encrypt Response or Assertion, but it's available in Onelogin if needed.