Issues

• Redirect binding inflates without an output-size cap (memory-amplification DoS)

  api7/lua-resty-saml#64 · Filter by author shreemaan-abhishek opened on Sep 21, 2026

• saml_binding_post_parse leaks the base64-decoded response buffer on every parse

  api7/lua-resty-saml#63 · Filter by author shreemaan-abhishek opened on Sep 21, 2026

• logout_callback ignores the signature-verification error, so an unsigned LogoutRequest tears down a session

  api7/lua-resty-saml#62 · Filter by author shreemaan-abhishek opened on Sep 21, 2026

• Loading resty.saml replaces the host's random seed with time + pid

  api7/lua-resty-saml#61 · Filter by author shreemaan-abhishek opened on Sep 17, 2026
  

• Makefile: single-run archive bootstrap and honest dependencies

  api7/lua-resty-saml#59 · Filter by author shreemaan-abhishek opened on Sep 1, 2026

• Unify the three OneTimeUse diagnostics

  api7/lua-resty-saml#57 · Filter by author shreemaan-abhishek opened on Aug 31, 2026
  1

  

• Replay record: fallback shorter than known closes, and non-bearer confirmations shrink it

  api7/lua-resty-saml#56 · Filter by author shreemaan-abhishek opened on Aug 31, 2026
  2

  

• Refuse more than one OneTimeUse or ProxyRestriction in a Conditions

  api7/lua-resty-saml#55 · Filter by author shreemaan-abhishek opened on Aug 27, 2026
  

• Conditions spelled through xsi:type are refused, and the refusal does not say which

  api7/lua-resty-saml#54 · Filter by author shreemaan-abhishek opened on Aug 27, 2026
  

• login_callback ignores sess:save() failure, redirecting a user who got no session

  api7/lua-resty-saml#52 · Filter by author shreemaan-abhishek opened on Aug 27, 2026

• Replay tracking is per instance, and a complete guarantee needs a shared record

  api7/lua-resty-saml#51 · Filter by author shreemaan-abhishek opened on Aug 26, 2026

• idp_issuers is enforced on login but not on logout

  api7/lua-resty-saml#49 · Filter by author shreemaan-abhishek opened on Aug 20, 2026
  1

• The issuer allow-list is not weighed again when a session resumes

  api7/lua-resty-saml#48 · Filter by author shreemaan-abhishek opened on Aug 20, 2026
  1

• Values from the network are logged unescaped, so log lines can be forged

  api7/lua-resty-saml#47 · Filter by author shreemaan-abhishek opened on Aug 20, 2026

• SubjectConfirmation Method is read but never checked

  api7/lua-resty-saml#45 · Filter by author shreemaan-abhishek opened on Aug 19, 2026
  1

• saml.verify_doc is exported without the identity-coverage check

  api7/lua-resty-saml#35 · Filter by author shreemaan-abhishek opened on Aug 12, 2026
  1

• Anchor the identity XPaths to the root Response

  api7/lua-resty-saml#34 · Filter by author shreemaan-abhishek opened on Aug 12, 2026
  1

• invalid signature algorithm

  api7/lua-resty-saml#22 · Filter by author wrathinmind opened on Aug 19, 2023

• feat: remove xsd files from luarocks install

  api7/lua-resty-saml#13 · Filter by author kingluo opened on Sep 4, 2022

• feat: return exception status and info

  enhancement
  api7/lua-resty-saml#12 · Filter by author kingluo opened on Sep 2, 2022