mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-13 21:01:21 +08:00
2d1db7a56e
Two bugs surfaced when running the SAML e2e suite against the live backend (in a separate PR): 1. Routes accessed `tenancy.config.auth.saml.connections[id].field` without first checking that the entry exists. With strict null checks off, TS types this as always-defined and the route 500'd with a TypeError on missing connections instead of returning 404. Add an explicit `id in connections` guard at the top of each route (login, acs, metadata). 2. SAML responses signed at the Response element (samlify default, also what Okta + Azure AD emit) failed verification because the backend was configured with wantAssertionsSigned=true, wantAuthnResponseSigned=false — i.e. demanded an Assertion-level signature. Per SAML 2.0 §4.1.4.2 either is valid. Flip to wantAuthnResponseSigned=true so we accept what real-world IdPs actually send. |
||
|---|---|---|
| .. | ||
| app | ||
| auto-migrations | ||
| lib | ||
| oauth | ||
| private | ||
| route-handlers | ||
| saml | ||
| utils | ||
| analytics.tsx | ||
| globals.d.ts | ||
| instrumentation.ts | ||
| polyfills.tsx | ||
| prisma-client.tsx | ||
| proxy.tsx | ||
| s3.tsx | ||
| smart-router.tsx | ||
| stack.tsx | ||