[PR #2996] [MERGED] Updated SAML ACS post to retain user session #6104

New Issue

OVERLORD · 2026-02-05T10:24:36+03:00

OVERLORD commented

2026-02-05 10:24:36 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/2996
Author: @ssddanbrown
Created: 10/20/2021
Status: ✅ Merged
Merged: 10/20/2021
Merged by: @ssddanbrown

Base: master ← Head: saml2_acs_session

📝 Commits (1)

cdef1b3 Updated SAML ACS post to retain user session

📊 Changes

4 files changed (+145 additions, -96 deletions)

View changed files

📝 app/Auth/Access/Saml2Service.php (+4 -1)
📝 app/Http/Controllers/Auth/Saml2Controller.php (+48 -6)
📝 routes/web.php (+2 -1)
📝 tests/Auth/Saml2Test.php (+91 -88)

📄 Description

Session was being lost due to the callback POST request cookies
not being provided due to samesite=lax. This instead adds an additional
hop in the flow to route the request via a GET request so the session is
retained. SAML POST data is stored encrypted in cache via a unique ID
then pulled out straight afterwards, and restored into POST for the SAML
toolkit to validate.

Updated testing to cover.

Fixes #2552

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/2996 **Author:** [@ssddanbrown](https://github.com/ssddanbrown) **Created:** 10/20/2021 **Status:** ✅ Merged **Merged:** 10/20/2021 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `master` ← **Head:** `saml2_acs_session` --- ### 📝 Commits (1) - [`cdef1b3`](https://github.com/BookStackApp/BookStack/commit/cdef1b3ab05123ed2d92047dc949f8e8b1e4aaa0) Updated SAML ACS post to retain user session ### 📊 Changes **4 files changed** (+145 additions, -96 deletions) <details> <summary>View changed files</summary> 📝 `app/Auth/Access/Saml2Service.php` (+4 -1) 📝 `app/Http/Controllers/Auth/Saml2Controller.php` (+48 -6) 📝 `routes/web.php` (+2 -1) 📝 `tests/Auth/Saml2Test.php` (+91 -88) </details> ### 📄 Description Session was being lost due to the callback POST request cookies not being provided due to samesite=lax. This instead adds an additional hop in the flow to route the request via a GET request so the session is retained. SAML POST data is stored encrypted in cache via a unique ID then pulled out straight afterwards, and restored into POST for the SAML toolkit to validate. Updated testing to cover. Fixes #2552 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:24:36 +03:00

OVERLORD closed this issue

2026-02-05 10:24:38 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6104