Add support for validating the max length of SAML 2.0 request/response.

Revsgaard · Revsgaard · commit 832772195c21 · 2023-10-27T12:16:24.000+02:00
Change samples to validate SAML 2.0 request/response.
Upgrade TestWebAppCoreNemLogin3Sp to .NET 7.
diff --git a/src/ITfoxtec.Identity.Saml2.Mvc/Extensions/HttpRequestExtensions.cs b/src/ITfoxtec.Identity.Saml2.Mvc/Extensions/HttpRequestExtensions.cs
@@ -1,4 +1,5 @@
-﻿using System.Web;
+﻿using ITfoxtec.Identity.Saml2.Schemas;
+using System.Web;
 using System;
 using System.IO;
 
@@ -12,16 +13,50 @@ public static class HttpRequestExtensions
         /// <summary>
         /// Converts a System.Web.HttpRequestBase to ITfoxtec.Identity.Saml2.Http.HttpRequest.
         /// </summary>
-        public static Http.HttpRequest ToGenericHttpRequest(this HttpRequestBase request, bool readBodyAsString = false)
+        public static Http.HttpRequest ToGenericHttpRequest(this HttpRequestBase request, bool readBodyAsString = false, bool validate = false)
         {
-            return new Http.HttpRequest
+            var samlHttpRequest = new Http.HttpRequest
             {
                 Method = request.HttpMethod,
                 QueryString = request.Url.Query,
                 Query = request.QueryString,
                 Form = "POST".Equals(request.HttpMethod, StringComparison.InvariantCultureIgnoreCase) ? request.Form : null,
                 Body = ReadBody(request, readBodyAsString)
             };
+
+            if (validate)
+            {
+                var length = 0;
+                if (!string.IsNullOrEmpty(samlHttpRequest.QueryString))
+                {
+                    length += samlHttpRequest.QueryString.Length;
+                }
+                if (readBodyAsString)
+                {
+                    if (!string.IsNullOrEmpty(samlHttpRequest.Body))
+                    {
+                        length += samlHttpRequest.Body.Length;
+                    }
+                }
+                else
+                {
+                    if (samlHttpRequest.Form != null)
+                    {
+                        foreach (string item in samlHttpRequest.Form)
+                        {
+                            if (!string.IsNullOrEmpty(item))
+                            {
+                                length += item.Length;
+                            }
+                        }
+                    }
+                }
+                if (length > Saml2Constants.RequestResponseMaxLength)
+                {
+                    throw new Saml2RequestException($"Invalid SAML 2.0 request/response with a length of {length}, max length {Saml2Constants.RequestResponseMaxLength}.");
+                }
+            }
+            return samlHttpRequest;
         }
 
         private static string ReadBody(HttpRequestBase request, bool readBodyAsString)
diff --git a/src/ITfoxtec.Identity.Saml2.Mvc/ITfoxtec.Identity.Saml2.Mvc.csproj b/src/ITfoxtec.Identity.Saml2.Mvc/ITfoxtec.Identity.Saml2.Mvc.csproj
@@ -26,10 +26,10 @@ Support the Danish NemLog-in 2 / OIOSAML 2 and NemLog-in 3 / OIOSAML 3.</Descrip
     <PackageTags>SAML SAML 2.0 SAML2.0 SAML2 SAML 2 SAML-P SAMLP SSO Identity Provider (IdP) and Relying Party (RP) Authentication Metadata OIOSAML OIOSAML 2 OIOSAML 3 NemLogin NemLog-in 2 NemLog-in 3 ASP.NET MVC</PackageTags>
     <NeutralLanguage>en-US</NeutralLanguage>
     <PackageIconUrl>https://itfoxtec.com/favicon.ico</PackageIconUrl>
-    <AssemblyVersion>4.10.1.0</AssemblyVersion>
-    <FileVersion>4.10.1.0</FileVersion>
+    <AssemblyVersion>4.10.2.0</AssemblyVersion>
+    <FileVersion>4.10.2.0</FileVersion>
     <Copyright>Copyright © 2023</Copyright>
-    <Version>4.10.1</Version>
+    <Version>4.10.2</Version>
     <SignAssembly>true</SignAssembly>
     <AssemblyOriginatorKeyFile>ITfoxtec.SAML2.snk</AssemblyOriginatorKeyFile>
     <DelaySign>false</DelaySign>
diff --git a/src/ITfoxtec.Identity.Saml2.MvcCore/Extensions/HttpRequestExtensions.cs b/src/ITfoxtec.Identity.Saml2.MvcCore/Extensions/HttpRequestExtensions.cs
@@ -6,6 +6,7 @@
 using System;
 using System.IO;
 using System.Threading.Tasks;
+using ITfoxtec.Identity.Saml2.Schemas;
 
 namespace ITfoxtec.Identity.Saml2.MvcCore
 {
@@ -17,29 +18,66 @@ public static class HttpRequestExtensions
         /// <summary>
         /// Converts a Microsoft.AspNet.Http.HttpRequest to ITfoxtec.Identity.Saml2.Http.HttpRequest.
         /// </summary>
-        public static Http.HttpRequest ToGenericHttpRequest(this HttpRequest request)
+        public static Http.HttpRequest ToGenericHttpRequest(this HttpRequest request, bool validate = false)
         {
-            return new Http.HttpRequest
+            var samlHttpRequest = new Http.HttpRequest
             {
                 Method = request.Method,
                 QueryString = request.QueryString.Value,
                 Query = ToNameValueCollection(request.Query),
                 Form = "POST".Equals(request.Method, StringComparison.InvariantCultureIgnoreCase) ? ToNameValueCollection(request.Form) : null
             };
+
+            if (validate)
+            {
+                var length = 0;
+                if (!string.IsNullOrEmpty(samlHttpRequest.QueryString))
+                {
+                    length += samlHttpRequest.QueryString.Length;
+                }
+                if (samlHttpRequest.Form != null)
+                {
+                    foreach (string item in samlHttpRequest.Form)
+                    {
+                        if (!string.IsNullOrEmpty(item))
+                        {
+                            length += item.Length;
+                        }
+                    }
+                }
+                if (length > Saml2Constants.RequestResponseMaxLength)
+                {
+                    throw new Saml2RequestException($"Invalid SAML 2.0 request/response with a length of {length}, max length {Saml2Constants.RequestResponseMaxLength}.");
+                }
+            }
+            return samlHttpRequest;
         }
 
         /// <summary>
         /// Converts a Microsoft.AspNet.Http.HttpRequest to ITfoxtec.Identity.Saml2.Http.HttpRequest.
         /// </summary>
-        public static async Task<Http.HttpRequest> ToGenericHttpRequestAsync(this HttpRequest request, bool readBodyAsString = false)
+        public static async Task<Http.HttpRequest> ToGenericHttpRequestAsync(this HttpRequest request, bool readBodyAsString = false, bool validate = false)
         {
             if (readBodyAsString)
             {
-                return new Http.HttpRequest
+                var samlHttpRequest = new Http.HttpRequest
                 {
                     Method = request.Method,
                     Body = await ReadBodyStringAsync(request)
                 };
+
+                if (validate)
+                {
+                    if (!string.IsNullOrEmpty(samlHttpRequest.Body))
+                    {
+                        var length = samlHttpRequest.Body.Length;
+                        if (length > Saml2Constants.RequestResponseMaxLength)
+                        {
+                            throw new Saml2RequestException($"Invalid SAML 2.0 request/response with a length of {length}, max length {Saml2Constants.RequestResponseMaxLength}.");
+                        }
+                    }
+                }
+                return samlHttpRequest;
             }
             else
             {
diff --git a/src/ITfoxtec.Identity.Saml2.MvcCore/ITfoxtec.Identity.Saml2.MvcCore.csproj b/src/ITfoxtec.Identity.Saml2.MvcCore/ITfoxtec.Identity.Saml2.MvcCore.csproj
@@ -30,10 +30,10 @@ Support the Danish NemLog-in 2 / OIOSAML 2 and NemLog-in 3 / OIOSAML 3.</Descrip
     <PackageTags>SAML SAML 2.0 SAML2.0 SAML2 SAML 2 SAML-P SAMLP SSO Identity Provider (IdP) Relying Party (RP) Authentication Metadata OIOSAML OIOSAML 2 OIOSAML 3 NemLogin NemLog-in 2 NemLog-in 3 ASP.NET MVC Core</PackageTags>
     <NeutralLanguage>en-US</NeutralLanguage>
     <PackageIconUrl>https://itfoxtec.com/favicon.ico</PackageIconUrl>
-    <AssemblyVersion>4.10.1.0</AssemblyVersion>
-    <FileVersion>4.10.1.0</FileVersion>
+    <AssemblyVersion>4.10.2.0</AssemblyVersion>
+    <FileVersion>4.10.2.0</FileVersion>
     <Copyright>Copyright © 2023</Copyright>
-    <Version>4.10.1</Version>
+    <Version>4.10.2</Version>
     <SignAssembly>true</SignAssembly>
     <AssemblyOriginatorKeyFile>ITfoxtec.SAML2.snk</AssemblyOriginatorKeyFile>
     <DelaySign>false</DelaySign>
diff --git a/src/ITfoxtec.Identity.Saml2/ITfoxtec.Identity.Saml2.csproj b/src/ITfoxtec.Identity.Saml2/ITfoxtec.Identity.Saml2.csproj
@@ -31,10 +31,10 @@ Support the Danish NemLog-in 2 / OIOSAML 2 and NemLog-in 3 / OIOSAML 3.</Descrip
     <PackageTags>SAML SAML 2.0 SAML2.0 SAML2 SAML 2 SAML-P SAMLP SSO Identity Provider (IdP) Relying Party (RP) Authentication Metadata OIOSAML OIOSAML 2 OIOSAML 3 NemLogin NemLog-in 2 NemLog-in 3</PackageTags>
     <NeutralLanguage>en-US</NeutralLanguage>
     <PackageIconUrl>https://itfoxtec.com/favicon.ico</PackageIconUrl>
-    <AssemblyVersion>4.10.1.0</AssemblyVersion>
-    <FileVersion>4.10.1.0</FileVersion>
+    <AssemblyVersion>4.10.2.0</AssemblyVersion>
+    <FileVersion>4.10.2.0</FileVersion>
     <Copyright>Copyright © 2023</Copyright>
-    <Version>4.10.1</Version>
+    <Version>4.10.2</Version>
     <SignAssembly>true</SignAssembly>
     <AssemblyOriginatorKeyFile>ITfoxtec.SAML2.snk</AssemblyOriginatorKeyFile>
     <DelaySign>false</DelaySign>
diff --git a/src/ITfoxtec.Identity.Saml2/Schemas/Saml2Constants.cs b/src/ITfoxtec.Identity.Saml2/Schemas/Saml2Constants.cs
@@ -5,6 +5,11 @@ namespace ITfoxtec.Identity.Saml2.Schemas
 {
     public static class Saml2Constants
     {
+        /// <summary>
+        /// SAML 2.0 request / response max length.
+        /// </summary>
+        public const int RequestResponseMaxLength = 100000;
+
         /// <summary>
         /// SAML 2.0 Authentication Type.
         /// </summary>
diff --git a/test/TestIdPCore/Controllers/AuthController.cs b/test/TestIdPCore/Controllers/AuthController.cs
@@ -47,7 +47,7 @@ public async Task<IActionResult> Login()
             var saml2AuthnRequest = new Saml2AuthnRequest(GetRpSaml2Configuration(relyingParty));
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnRequest);
 
                 // ****  Handle user login e.g. in GUI ****
                 // Test user with session index and claims
@@ -108,7 +108,7 @@ public async Task<IActionResult> Logout()
             var saml2LogoutRequest = new Saml2LogoutRequest(GetRpSaml2Configuration(relyingParty));
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), saml2LogoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2LogoutRequest);
 
                 // **** Delete user session ****
 
@@ -125,12 +125,12 @@ public async Task<IActionResult> Logout()
 
         private string ReadRelyingPartyFromLoginRequest<T>(Saml2Binding<T> binding)
         {
-            return binding.ReadSamlRequest(Request.ToGenericHttpRequest(), new Saml2AuthnRequest(GetRpSaml2Configuration()))?.Issuer;
+            return binding.ReadSamlRequest(Request.ToGenericHttpRequest(validate: true), new Saml2AuthnRequest(GetRpSaml2Configuration()))?.Issuer;
         }
 
         private string ReadRelyingPartyFromLogoutRequest<T>(Saml2Binding<T> binding)
         {
-            return binding.ReadSamlRequest(Request.ToGenericHttpRequest(), new Saml2LogoutRequest(GetRpSaml2Configuration()))?.Issuer;
+            return binding.ReadSamlRequest(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutRequest(GetRpSaml2Configuration()))?.Issuer;
         }
 
         private string ReadRelyingPartyFromSoapEnvelopeRequest<T>(ITfoxtec.Identity.Saml2.Http.HttpRequest httpRequest, Saml2Binding<T> binding)
diff --git a/test/TestWebApp/Controllers/AuthController.cs b/test/TestWebApp/Controllers/AuthController.cs
@@ -45,12 +45,12 @@ public ActionResult AssertionConsumerService()
             var binding = new Saml2PostBinding();
             var saml2AuthnResponse = new Saml2AuthnResponse(config);
 
-            binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
             {
                 throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
             }
-            binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             saml2AuthnResponse.CreateSession(claimsAuthenticationManager: new DefaultClaimsAuthenticationManager());
 
             var relayStateQuery = binding.GetRelayStateQuery();
@@ -74,7 +74,7 @@ public ActionResult Logout()
         public ActionResult LoggedOut()
         {
             var binding = new Saml2PostBinding();
-            binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));
 
             FederatedAuthentication.SessionAuthenticationModule.DeleteSessionTokenCookie();
             FederatedAuthentication.SessionAuthenticationModule.SignOut();
@@ -89,7 +89,7 @@ public ActionResult SingleLogout()
             var logoutRequest = new Saml2LogoutRequest(config, ClaimsPrincipal.Current);
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);
                 status = Saml2StatusCodes.Success;
                 logoutRequest.DeleteSession();
             }
diff --git a/test/TestWebAppCore/Controllers/AuthController.cs b/test/TestWebAppCore/Controllers/AuthController.cs
@@ -50,12 +50,12 @@ public async Task<IActionResult> AssertionConsumerService()
             var binding = new Saml2PostBinding();
             var saml2AuthnResponse = new Saml2AuthnResponse(config);
 
-            binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
             {
                 throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
             }
-            binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));
 
             var relayStateQuery = binding.GetRelayStateQuery();
@@ -81,7 +81,7 @@ public async Task<IActionResult> Logout()
         public IActionResult LoggedOut()
         {
             var binding = new Saml2PostBinding();
-            binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));
 
             return Redirect(Url.Content("~/"));
         }
@@ -94,7 +94,7 @@ public async Task<IActionResult> SingleLogout()
             var logoutRequest = new Saml2LogoutRequest(config, User);
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);
                 status = Saml2StatusCodes.Success;
                 await logoutRequest.DeleteSession(HttpContext);
             }
diff --git a/test/TestWebAppCoreAngularApi/Controllers/AuthController.cs b/test/TestWebAppCoreAngularApi/Controllers/AuthController.cs
@@ -49,12 +49,12 @@ public async Task<IActionResult> AssertionConsumerService()
             var binding = new Saml2PostBinding();
             var saml2AuthnResponse = new Saml2AuthnResponse(config);
 
-            binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
             {
                 throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
             }
-            binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));
 
             var relayStateQuery = binding.GetRelayStateQuery();
@@ -80,7 +80,7 @@ public async Task<IActionResult> Logout()
         public IActionResult LoggedOut()
         {
             var binding = new Saml2PostBinding();
-            binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));
 
             return Redirect(Url.Content("~/"));
         }
@@ -93,7 +93,7 @@ public async Task<IActionResult> SingleLogout()
             var logoutRequest = new Saml2LogoutRequest(config, User);
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);
                 status = Saml2StatusCodes.Success;
                 await logoutRequest.DeleteSession(HttpContext);
             }
diff --git a/test/TestWebAppCoreArtifact/Controllers/AuthController.cs b/test/TestWebAppCoreArtifact/Controllers/AuthController.cs
@@ -52,7 +52,7 @@ public async Task<IActionResult> AssertionConsumerService()
         {
             var binding = new Saml2ArtifactBinding();
             var saml2ArtifactResolve = new Saml2ArtifactResolve(config);
-            binding.Unbind(Request.ToGenericHttpRequest(), saml2ArtifactResolve);
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2ArtifactResolve);
 
             var soapEnvelope = new Saml2SoapEnvelope();
             var saml2AuthnResponse = new Saml2AuthnResponse(config);
@@ -87,7 +87,7 @@ public async Task<IActionResult> Logout()
         public IActionResult LoggedOut()
         {
             var binding = new Saml2PostBinding();
-            binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));
 
             return Redirect(Url.Content("~/"));
         }
@@ -100,7 +100,7 @@ public async Task<IActionResult> SingleLogout()
             var logoutRequest = new Saml2LogoutRequest(config, User);
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);
                 status = Saml2StatusCodes.Success;
                 await logoutRequest.DeleteSession(HttpContext);
             }
diff --git a/test/TestWebAppCoreAzureKeyVault/Controllers/AuthController.cs b/test/TestWebAppCoreAzureKeyVault/Controllers/AuthController.cs
@@ -49,12 +49,12 @@ public async Task<IActionResult> AssertionConsumerService()
             var binding = new Saml2PostBinding();
             var saml2AuthnResponse = new Saml2AuthnResponse(config);
 
-            binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)
             {
                 throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");
             }
-            binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);
             await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));
 
             var relayStateQuery = binding.GetRelayStateQuery();
@@ -80,7 +80,7 @@ public async Task<IActionResult> Logout()
         public IActionResult LoggedOut()
         {
             var binding = new Saml2PostBinding();
-            binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));
+            binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));
 
             return Redirect(Url.Content("~/"));
         }
@@ -93,7 +93,7 @@ public async Task<IActionResult> SingleLogout()
             var logoutRequest = new Saml2LogoutRequest(config, User);
             try
             {
-                requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);
+                requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);
                 status = Saml2StatusCodes.Success;
                 await logoutRequest.DeleteSession(HttpContext);
             }
diff --git a/test/TestWebAppCoreFramework/Controllers/AuthController.cs b/test/TestWebAppCoreFramework/Controllers/AuthController.cs
diff --git a/test/TestWebAppCoreNemLogin3Sp/Controllers/AuthController.cs b/test/TestWebAppCoreNemLogin3Sp/Controllers/AuthController.cs
diff --git a/test/TestWebAppCoreNemLogin3Sp/TestWebAppCoreNemLogin3Sp.csproj b/test/TestWebAppCoreNemLogin3Sp/TestWebAppCoreNemLogin3Sp.csproj

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,11 @@ namespace ITfoxtec.Identity.Saml2.Schemas`
`5`	`5`	`{`
`6`	`6`	`public static class Saml2Constants`
`7`	`7`	`{`
	`8`	`+ /// <summary>`
	`9`	`+ /// SAML 2.0 request / response max length.`
	`10`	`+ /// </summary>`
	`11`	`+ public const int RequestResponseMaxLength = 100000;`
	`12`	`+`
`8`	`13`	`/// <summary>`
`9`	`14`	`/// SAML 2.0 Authentication Type.`
`10`	`15`	`/// </summary>`
Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ public async Task<IActionResult> Login()`
`47`	`47`	`var saml2AuthnRequest = new Saml2AuthnRequest(GetRpSaml2Configuration(relyingParty));`
`48`	`48`	`try`
`49`	`49`	`{`
`50`		`- requestBinding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnRequest);`
	`50`	`+ requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnRequest);`
`51`	`51`
`52`	`52`	`// ** Handle user login e.g. in GUI **`
`53`	`53`	`// Test user with session index and claims`
`@@ -108,7 +108,7 @@ public async Task<IActionResult> Logout()`
`108`	`108`	`var saml2LogoutRequest = new Saml2LogoutRequest(GetRpSaml2Configuration(relyingParty));`
`109`	`109`	`try`
`110`	`110`	`{`
`111`		`- requestBinding.Unbind(Request.ToGenericHttpRequest(), saml2LogoutRequest);`
	`111`	`+ requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2LogoutRequest);`
`112`	`112`
`113`	`113`	`// ** Delete user session **`
`114`	`114`
`@@ -125,12 +125,12 @@ public async Task<IActionResult> Logout()`
`125`	`125`
`126`	`126`	`private string ReadRelyingPartyFromLoginRequest<T>(Saml2Binding<T> binding)`
`127`	`127`	`{`
`128`		`- return binding.ReadSamlRequest(Request.ToGenericHttpRequest(), new Saml2AuthnRequest(GetRpSaml2Configuration()))?.Issuer;`
	`128`	`+ return binding.ReadSamlRequest(Request.ToGenericHttpRequest(validate: true), new Saml2AuthnRequest(GetRpSaml2Configuration()))?.Issuer;`
`129`	`129`	`}`
`130`	`130`
`131`	`131`	`private string ReadRelyingPartyFromLogoutRequest<T>(Saml2Binding<T> binding)`
`132`	`132`	`{`
`133`		`- return binding.ReadSamlRequest(Request.ToGenericHttpRequest(), new Saml2LogoutRequest(GetRpSaml2Configuration()))?.Issuer;`
	`133`	`+ return binding.ReadSamlRequest(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutRequest(GetRpSaml2Configuration()))?.Issuer;`
`134`	`134`	`}`
`135`	`135`
`136`	`136`	`private string ReadRelyingPartyFromSoapEnvelopeRequest<T>(ITfoxtec.Identity.Saml2.Http.HttpRequest httpRequest, Saml2Binding<T> binding)`
Original file line number	Diff line number	Diff line change
`@@ -45,12 +45,12 @@ public ActionResult AssertionConsumerService()`
`45`	`45`	`var binding = new Saml2PostBinding();`
`46`	`46`	`var saml2AuthnResponse = new Saml2AuthnResponse(config);`
`47`	`47`
`48`		`- binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`48`	`+ binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`49`	`49`	`if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)`
`50`	`50`	`{`
`51`	`51`	`throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");`
`52`	`52`	`}`
`53`		`- binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`53`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`54`	`54`	`saml2AuthnResponse.CreateSession(claimsAuthenticationManager: new DefaultClaimsAuthenticationManager());`
`55`	`55`
`56`	`56`	`var relayStateQuery = binding.GetRelayStateQuery();`
`@@ -74,7 +74,7 @@ public ActionResult Logout()`
`74`	`74`	`public ActionResult LoggedOut()`
`75`	`75`	`{`
`76`	`76`	`var binding = new Saml2PostBinding();`
`77`		`- binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));`
	`77`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));`
`78`	`78`
`79`	`79`	`FederatedAuthentication.SessionAuthenticationModule.DeleteSessionTokenCookie();`
`80`	`80`	`FederatedAuthentication.SessionAuthenticationModule.SignOut();`
`@@ -89,7 +89,7 @@ public ActionResult SingleLogout()`
`89`	`89`	`var logoutRequest = new Saml2LogoutRequest(config, ClaimsPrincipal.Current);`
`90`	`90`	`try`
`91`	`91`	`{`
`92`		`- requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);`
	`92`	`+ requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);`
`93`	`93`	`status = Saml2StatusCodes.Success;`
`94`	`94`	`logoutRequest.DeleteSession();`
`95`	`95`	`}`
Original file line number	Diff line number	Diff line change
`@@ -50,12 +50,12 @@ public async Task<IActionResult> AssertionConsumerService()`
`50`	`50`	`var binding = new Saml2PostBinding();`
`51`	`51`	`var saml2AuthnResponse = new Saml2AuthnResponse(config);`
`52`	`52`
`53`		`- binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`53`	`+ binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`54`	`54`	`if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)`
`55`	`55`	`{`
`56`	`56`	`throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");`
`57`	`57`	`}`
`58`		`- binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`58`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`59`	`59`	`await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));`
`60`	`60`
`61`	`61`	`var relayStateQuery = binding.GetRelayStateQuery();`
`@@ -81,7 +81,7 @@ public async Task<IActionResult> Logout()`
`81`	`81`	`public IActionResult LoggedOut()`
`82`	`82`	`{`
`83`	`83`	`var binding = new Saml2PostBinding();`
`84`		`- binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));`
	`84`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));`
`85`	`85`
`86`	`86`	`return Redirect(Url.Content("~/"));`
`87`	`87`	`}`
`@@ -94,7 +94,7 @@ public async Task<IActionResult> SingleLogout()`
`94`	`94`	`var logoutRequest = new Saml2LogoutRequest(config, User);`
`95`	`95`	`try`
`96`	`96`	`{`
`97`		`- requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);`
	`97`	`+ requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);`
`98`	`98`	`status = Saml2StatusCodes.Success;`
`99`	`99`	`await logoutRequest.DeleteSession(HttpContext);`
`100`	`100`	`}`
Original file line number	Diff line number	Diff line change
`@@ -49,12 +49,12 @@ public async Task<IActionResult> AssertionConsumerService()`
`49`	`49`	`var binding = new Saml2PostBinding();`
`50`	`50`	`var saml2AuthnResponse = new Saml2AuthnResponse(config);`
`51`	`51`
`52`		`- binding.ReadSamlResponse(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`52`	`+ binding.ReadSamlResponse(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`53`	`53`	`if (saml2AuthnResponse.Status != Saml2StatusCodes.Success)`
`54`	`54`	`{`
`55`	`55`	`throw new AuthenticationException($"SAML Response status: {saml2AuthnResponse.Status}");`
`56`	`56`	`}`
`57`		`- binding.Unbind(Request.ToGenericHttpRequest(), saml2AuthnResponse);`
	`57`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), saml2AuthnResponse);`
`58`	`58`	`await saml2AuthnResponse.CreateSession(HttpContext, claimsTransform: (claimsPrincipal) => ClaimsTransform.Transform(claimsPrincipal));`
`59`	`59`
`60`	`60`	`var relayStateQuery = binding.GetRelayStateQuery();`
`@@ -80,7 +80,7 @@ public async Task<IActionResult> Logout()`
`80`	`80`	`public IActionResult LoggedOut()`
`81`	`81`	`{`
`82`	`82`	`var binding = new Saml2PostBinding();`
`83`		`- binding.Unbind(Request.ToGenericHttpRequest(), new Saml2LogoutResponse(config));`
	`83`	`+ binding.Unbind(Request.ToGenericHttpRequest(validate: true), new Saml2LogoutResponse(config));`
`84`	`84`
`85`	`85`	`return Redirect(Url.Content("~/"));`
`86`	`86`	`}`
`@@ -93,7 +93,7 @@ public async Task<IActionResult> SingleLogout()`
`93`	`93`	`var logoutRequest = new Saml2LogoutRequest(config, User);`
`94`	`94`	`try`
`95`	`95`	`{`
`96`		`- requestBinding.Unbind(Request.ToGenericHttpRequest(), logoutRequest);`
	`96`	`+ requestBinding.Unbind(Request.ToGenericHttpRequest(validate: true), logoutRequest);`
`97`	`97`	`status = Saml2StatusCodes.Success;`
`98`	`98`	`await logoutRequest.DeleteSession(HttpContext);`
`99`	`99`	`}`