Feature Request: Use dynamic value in the cookie for SAML and OpenID authentication

Is your feature request related to a problem?

#34

Solution you'd like

Generate a unique nonce (UUID) per login attempt when the user is redirected to the IdP.
Store the token as putToken(nonce, userToken) instead of the fixed "samlSso" key.
Put the nonce in the temp cookie, so the second-phase PATCH /token_auth_server uniquely identifies the login attempt.
Optionally pass the nonce as RelayState to the IdP for callback validation.
Validate and invalidate the specific nonce on the PATCH call — preventing replay and cleaning up stale entries.
Apply the same fix to OpenIdAuthService.scala — confirmed to use the identical KEY = "samlSso" pattern.
Add TTL/cleanup for pending login entries to prevent unbounded in-memory map growth.

Alternatives you've considered

No response

Anything else?

No response

The test was completed, and the following test scenarios were passed.

Test build:
- 10.112.240.103:5000/neuvector/manager:1289-4
- 10.112.240.103:5000/neuvector/controller:william-34-39
Test scenarios:
- Dynamic Cookie Uniqueness (SAML & OpenID): Verified across both SAML and OpenID authentication flows that the temp cookie value in the PATCH /token_auth_server request is now a dynamically generated, unique UUID (nonce) for every single login attempt, rather than a static string.
- Nonce Consumption & Replay Prevention: Confirmed that once a nonce is successfully used for authentication, it is immediately invalidated. Attempting a replay attack by resending the exact same PATCH request with a consumed temp cookie is successfully rejected by the backend (401 Unauthorized), effectively preventing state confusion and replay attacks.

Reopen for backport to 5.4.x and 5.5.x

neuvector#1271 Feature Request: Use dynamic value in the cookie for S…

#1271 Feature Request: Use dynamic value in the cookie for SAML and O…

In 5.4.11, 5.5.4 and 5.6.2 now

Navigation Menu

Repository navigation

Feature Request: Use dynamic value in the cookie for SAML and OpenID authentication #1271

Is your feature request related to a problem?

Solution you'd like

Alternatives you've considered

Anything else?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Feature Request: Use dynamic value in the cookie for SAML and OpenID authentication #1271

Description

Is your feature request related to a problem?

Solution you'd like

Alternatives you've considered

Anything else?

Activity

leotseng-suse commented on Sep 8, 2026

xingzhang-suse commented on Sep 9, 2026

xingzhang-suse commented on Sep 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions