All issues

Search results

Refuse more than one OneTimeUse or ProxyRestriction in a Conditions

Status: Open.

#55 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 27, 2026

Conditions spelled through xsi:type are refused, and the refusal does not say which

Status: Open.

#54 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 27, 2026

login_callback ignores sess:save() failure, redirecting a user who got no session

Status: Open.

#52 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 27, 2026

Replay tracking is per instance, and a complete guarantee needs a shared record

Status: Open.

#51 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 26, 2026

idp_issuers is enforced on login but not on logout

Status: Open.

#49 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 20, 2026

The issuer allow-list is not weighed again when a session resumes

Status: Open.

#48 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 20, 2026

Values from the network are logged unescaped, so log lines can be forged

Status: Open.

#47 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 20, 2026

Honour OneTimeUse when replay tracking is configured

Status: Open.

#46 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 19, 2026

SubjectConfirmation Method is read but never checked

Status: Open.

#45 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 19, 2026

saml.verify_doc is exported without the identity-coverage check

Status: Open.

#35 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 12, 2026

Anchor the identity XPaths to the root Response

Status: Open.

#34 In api7/lua-resty-saml;

· shreemaan-abhishek opened on Aug 12, 2026

invalid signature algorithm

Status: Open.

#22 In api7/lua-resty-saml;

· wrathinmind opened on Aug 19, 2023