Deflating request when sending POST

[nkovalenko-sc]

Hi. I have a problem with skipRequestCompression parameter.
If it's set to false then script (https://github.com/bergie/passport-saml/blob/master/lib/passport-saml/saml.js#L433) deflates request and sends deflated and base64 encoded request using POST (https://github.com/bergie/passport-saml/blob/master/lib/passport-saml/saml.js#L417).

But deflating must be used only when sending HTTP-Redirecting GET request regarding SAML documentation http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html.

Please, remove if (self.options.skipRequestCompression) condition and leave only getAuthorizeFormHelper function calling instead.

[markstos]

If you you've believe you've found a bug, please add new test coverage which illustrates the case, if possible.

[nkovalenko-sc]

Mhm, you can see the logic in provided links and I described the problem. Why do I need to implement a tests?
You have two choices: use GET instead of POST to send login request when skipRequestCompression is false.
Or disable deflating of request when sending login request when skipRequestCompression is false.

[sibelius]

I've hit this issue as well

when skipRequestCompression is false it does not work at well

[sibelius]

Here is more information about it

https://en.wikipedia.org/wiki/SAML_2.0#HTTP_Redirect_Binding

SAML requests or responses transmitted via HTTP Redirect have a SAMLRequest or SAMLResponse query string parameter, respectively. Before it's sent, the message is deflated (without header and checksum), base64-encoded, and URL-encoded, in that order. Upon receipt, the process is reversed to recover the original message.

[markstos]

@sibelius It sounds like we might not be spec-compliant here, but this isn't a feature I use. Would you be interested in submitting a patch?

@nkovalenko-sc To answer your question: Why do I need to implement a tests? Because this is a community-maintained open source project. No one here is paid to work on the project for you. If you've run into something that seems to be working not quite right for you, you are precisely the person with an incentive to fix it. Automated tests help insure the correctness of the code changes. (In this case, @sibelius has also run into the issue, so perhaps @sibelius will contribute a patch.

[fcorneli]

When using

authnRequestBinding: "HTTP-POST"

the compression should indeed not kick in.