coheigea opened a new pull request, #3631: URL: https://github.com/apache/cxf/pull/3631
SAMLSSOResponseValidator only checked the replay cache when the Response was received via the POST binding, and AbstractRequestAssertionConsumerHandler only set the replay cache on the validator in that case. A Response delivered via GET, which is the default for RequestAssertionConsumerFilter, was therefore never cached, so the same response could be submitted again until the assertion expired. Set the replay cache and check bearer assertion IDs for every binding. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
