Handle SP-initiated vs IdP-initiated SAML flows and RelayState pitfalls

Verified steps

1. For SP-initiated flow, generate an AuthnRequest with a unique ID and timestamp, embed the RelayState with the intended post-login destination URL, and redirect or POST to the IdP SSO endpoint.
2. The IdP authenticates the user and returns a SAMLResponse to the SP's Assertion Consumer Service URL; the SP validates signatures, NotBefore/NotOnOrAfter conditions, and the InResponseTo attribute to tie the response to your request.
3. For IdP-initiated flow no AuthnRequest exists; the SP receives an unsolicited SAMLResponse and must validate it without an InResponseTo match — implement an allowlist of permitted IdP-initiated RelayState values to prevent open-redirect attacks.
4. Always validate that the Destination attribute in the response matches your ACS URL and that the Issuer matches the registered IdP entity ID.
5. Prevent assertion replay by storing and checking the assertion ID against a short-lived cache (at minimum for the assertion validity window).
6. Return the user to the RelayState URL only after full validation; sanitize it to only permit relative paths or explicitly allowlisted absolute URLs.