Validate the XML schema of the SAML Response before any signature verification; reject documents that fail schema validation — do not pass malformed XML to the signature verifier
Verify that the Signature element's Reference URI points to the Assertion being validated; check that the ID attribute of the validated element matches the Reference URI exactly, and that only one Assertion is signed
Use a StaticKeySelector seeded with the IdP's certificate (fetched via metadata and pinned locally) rather than trusting KeyInfo in the received document — an attacker can inject a KeyInfo with their own key
After signature verification, extract data from the same element node that was verified — many vulnerabilities arise from verifying one node and reading data from a different node injected by the attacker
Enable ForceAuthn and validate AuthnInstant recency to prevent replay attacks; maintain a used-assertion cache indexed by the Assertion ID to detect duplicate submissions
Keep the SAML library dependency current; CVE-2025-47949 (samlify < 2.10.0) and Ruby-SAML CVEs (CVE-2025-66568/66567 in versions prior to 1.18.0) are active signature wrapping vulnerabilities from 2025
Known gotchas
ID attributes in XML must be registered with the parser as type ID for ID-based dereferencing to work correctly; parsers that treat ID attributes as plain strings can be fooled by attacker-injected elements with the same string value
Canonicalization algorithm selection matters: the signed content is the canonicalized form of the element; if your verifier canonicalizes differently from the signer, legitimate assertions will fail verification
IdP-initiated SAML flows bypass ForceAuthn controls and are harder to protect against replay; prefer SP-initiated flows for sensitive operations and validate RelayState to prevent open-redirect attacks
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp