In SAML, man in the middle attack, for unsigned saml response, can the attacker modify values?
Summary The question revolves around the security of SAML (Security Assertion Markup Language) responses, specifically when they are unsigned. In a man-in-the-middle (MITM) attack, an attacker can intercept and modify the SAML response. The key concern is whether an attacker can create a new assertionId and modify the notBefore and notAfter timestamps in an unsigned … Read more