Skip to content

Commit 88ffba6

Browse files
committed
Clarify the real nature of the RelayState parameter for SSO and SLO
In the most simple case, the RelayState may be used as a "returnUrl", but I think it's important to underline that the RelayState does not necessarily need to be a return URL. Indeed, the SAML 2.0 specification clarifies that a limit of max 80 characters exists for it (at least in the case of the HTTP-Redirect binding) and that a protection method against tampering is suggested. Therefore, a return URL in general would probably be a non-ideal use of the RelayState parameter, so let's give the latter the relevance it deserves.
1 parent 523786b commit 88ffba6

File tree

2 files changed

+232
-101
lines changed

2 files changed

+232
-101
lines changed

README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -433,10 +433,10 @@ The AuthNRequest will be sent signed or unsigned based on the security settings
433433

434434
The IdP will then return the SAML Response to the user's client. The client is then forwarded to the Attribute Consumer Service of the SP with this information.
435435

436-
We can set a 'returnTo' url parameter to the login function and that will be converted as a 'RelayState' parameter:
436+
We can set a 'RelayState' parameter containing a return url to the login function:
437437
```
438-
String targetUrl = 'https://example.com';
439-
auth.login(returnTo=targetUrl)
438+
String returnUrl = 'https://example.com';
439+
auth.login(relayState=returnUrl)
440440
```
441441
The login method can receive 6 more optional parameters:
442442
- *forceAuthn* When true the AuthNRequest will have the 'ForceAuthn' attribute set to 'true'
@@ -605,10 +605,10 @@ The Logout Request will be sent signed or unsigned based on the security setting
605605

606606
The IdP will return the Logout Response through the user's client to the Single Logout Service of the SP.
607607

608-
We can set a 'returnTo' url parameter to the logout function and that will be converted as a 'RelayState' parameter:
608+
We can set a 'RelayState' parameter containing a return url to the login function:
609609
```
610-
String targetUrl = 'https://example.com';
611-
auth.logout(returnTo=targetUrl)
610+
String returnUrl = 'https://example.com';
611+
auth.logout(relayState=returnUrl)
612612
```
613613

614614
Also there are 7 optional parameters that can be set:

0 commit comments

Comments
 (0)