From 40df76d8b4e639385eae94ec96db66d758dff4fe Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Thu, 19 Mar 2026 16:07:53 +0100 Subject: [PATCH] Fix SAML ACS endpoint CORS rejection The SAML Assertion Consumer Service endpoint receives cross-origin POSTs from external identity providers by design. Bypass CSRF protection for this specific endpoint since the endpoint validates SAML response signatures itself. Signed-off-by: Bryan Frimin --- pkg/server/api/api.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go index f2017e8fa..f677cb042 100644 --- a/pkg/server/api/api.go +++ b/pkg/server/api/api.go @@ -128,6 +128,10 @@ func NewServer(cfg Config) (*Server, error) { } } + // The SAML Assertion Consumer Service endpoint receives cross-origin + // POSTs from external identity providers by design. + csrf.AddInsecureBypassPattern("POST /connect/v1/saml/2.0/consume") + csrf.SetDenyHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { httpserver.RenderJSON( w,