Tootfinder

from my link log —
SAML: A fractal of bad design.
https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/
saved 2026-09-23

SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness. Organizations should migrate to OpenID Connect (OIDC), which avoids these pitfalls through simpler JSON-based design, detached signatures, and agile evolution.