onelogin/ruby-saml — pull request #115 by kwugirl (2014-03-05 01:14:53+00:00)
Title: Add validation hooks for assertion ID, time range, recipient, and destination

Originally at https://github.com/onelogin/ruby-saml/pull/103 - original description copied below:

This pull request contains four additions:
1. A validation hook for the assertion ID. We found that we needed to ensure that we rejected reused assertion IDs so as to prevent replay attacks.
2. A validation hook for the time range conditions. We wanted to enforce sensible time range choices so that our customers wouldn't be unnecessarily weakening their security by making their assertions valid for long periods of time.
3. A validation hook for the recipient attribute. We wanted to protect our customers from attacks where an unauthorized user gains access by using a valid assertion for a different third-party Service Provider.
4. A validation hook for the destination attribute. Similar to #3, we wanted to protect our customers from attacks where an unauthorized user gains access by using a valid assertion for a different third-party Service Provider.

All these additions are covered with new tests as well.