This repository was archived by the owner on Sep 17, 2021. It is now read-only.
This repository was archived by the owner on Sep 17, 2021. It is now read-only.
CSRF protection on SSO API #593
Description
Looks like OneLogin sends its response SAML token as a POST request.
This is being blocked by the CSRF protection and returning
{"status": 400, "message": "Bad Request"}
You can solve this by adding a CSRF exempt for the SSO blueprint. E.g.
from security_monkey import db, rbac, csrf
mod = Blueprint('sso', __name__)
csrf.exempt(mod)
Given that the requests are authenticated and signed, I don't see a big issue with a CSRF exempt on SSO.