Spring Security SAML replay attack prevention

0
votes

As described in Profiles for the OASIS SecurityAssertion Markup Language (SAML)V2.0 (https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf) chapter 4.1.4.5 a service provider MUST prevent replay attacks by keeping a cache for a processed assertion during the time that an assertion is not expired.

I know that OpenSAML supports preventing replay attacks by offering a security policy and cache implementation against replays, but I cannot find the usage of those implementations anywhere in Spring SAML. I expect WebSSOProfileConsumer to provide such a functionality. Can anyone point me in the right direction on where (if at all) this behavior can be found?

1
springspring-securityspring-samlspring-security-saml2

1 Answers

0
votes

I haven't seen anything in Spring SAML that provides this out of the box. We need to do it from the application. Replay attack prevention needs to be done by storing the assertion's id and checking if a new assertion comes with the same id. You can get the ID using 

org.opensaml.saml2.core.Assertion.getID();