Is there a way to prevent Cognito from including Line Feed Characters ("\x0a") in SAML Requests.

0

We use Amplify with Cognito with logins, and have a federated identity provider that has reported that cognito sometimes includes line feed characters in generated SAML Requests. This is causing problems for them - They stated it is a security concern, however given that SAMLRequests from cognito are unsigned I imagine that they may be having difficulty parsing the value. I was not initially able to reproduce the issue, but I noticed that cognito seems to do this if the redirect is longer. (All the examples they sent had a redirect which was over 3000 characters long). Longer requests seem to be due to a larger than normal RelayState being included in the response.

So my question is 2 part:

  1. Is there a way to force cognito not to include line feed characters in the redirect?
  2. If not, is there a way to reduce the length of the RelayState (Given that this is a login, and that the RelayState is encrypted, I can't imagine what other data is being stored there.) Can amplify be used to clear the session? Will calling some sort of logout before logging in help here?
Nessuna risposta

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande