SAML: A Fractal of Bad Design
5 hours ago
- SAML (Security Assertion Markup Language) is an outdated authentication protocol with foundational flaws, including reliance on complex XML, which introduces numerous security issues like XXE and parser differentials.
- The protocol suffers from 'kitchen-sink' design, canonicalization problems, enveloped signature complexity, and ossification, failing to adapt to modern web requirements like mobile and single-page applications.
- Compared to newer alternatives like OIDC, SAML is overly complex and insecure; OIDC offers better transport independence, organic growth, and agile design, making it the recommended replacement.
- Despite its historical role in launching the SSO industry and enabling corporate authentication, SAML has become obsolete due to persistent vulnerabilities (e.g., XML signature wrapping) and impractical standards for today's architectures.