Clarify IdP-initiated SSO section: specify login CSRF, remove MITM re… #1876

[0xgaurav]

Summary

This PR improves the "IdP Initiated SAML SSO" section of the SAML Security Cheat Sheet.

• Removes an external reference incorrectly claiming IdP-initiated SSO is uniquely vulnerable to MITM.
• Clarifies that the main design limitation is the lack of login CSRF protection, since the SP cannot establish a pre-login state to bind the response.

Rationale

This aligns the cheat sheet with accurate security reasoning while keeping the focus on real, design-based risks rather than general TLS issues.

Covers: #1876

[mackowski]

@0xgaurav looks good but linter check if failing, please fix that. Also please next time use our PR template for Pull Request because it contains a checklist that would for example allow you to find and fix this much earlier.

[mackowski]

Also I see that this issue is assigned to @madaster97

[Copilot]

Pull Request Overview

This PR improves the documentation in the SAML Security Cheat Sheet by expanding and clarifying the security considerations for IdP-initiated SSO (Unsolicited Response). The changes provide more nuanced technical explanations of the security trade-offs involved.

• Clarified that IdP-initiated SSO specifically lacks "login CSRF" protection and explained why
• Added important context distinguishing MITM attack risks from login intent validation issues
• Improved explanation of backward compatibility rationale for continued IdP-initiated SSO support

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[0xgaurav]

Also I see that this issue is assigned to @madaster97

Thanks for letting me know! I didn’t realize this issue was already assigned — my apologies.