Socket
Socket
Sign inDemoInstall

passport-saml

Package Overview
Dependencies
Maintainers
4
Versions
68
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

passport-saml - npm Package Compare versions

Comparing version 1.3.1 to 1.3.2

13

lib/passport-saml/saml.js

@@ -142,3 +142,3 @@ var debug = require('debug')('passport-saml');

signer.update(querystring.stringify(samlMessageToSign));
samlMessage.Signature = signer.sign(this.keyToPEM(this.options.privateCert), 'base64');
samlMessage.Signature = signer.sign(this.options.privateCert, 'base64');
};

@@ -501,13 +501,2 @@

SAML.prototype.keyToPEM = function (key) {
key = key.match(/.{1,64}/g).join('\n');
if (key.indexOf('-BEGIN PRIVATE KEY-') === -1)
key = "-----BEGIN PRIVATE KEY-----\n" + key;
if (key.indexOf('-END PRIVATE KEY-') === -1)
key = key + "\n-----END PRIVATE KEY-----\n";
return key;
};
SAML.prototype.certsToCheck = function () {

@@ -514,0 +503,0 @@ if (!this.options.cert) {

4

package.json
{
"name": "passport-saml",
"version": "1.3.1",
"version": "1.3.2",
"license": "MIT",

@@ -34,3 +34,3 @@ "keywords": [

"xml-crypto": "^1.4.0",
"xml-encryption": "^0.11.0",
"xml-encryption": "^1.0.0",
"xml2js": "0.4.x",

@@ -37,0 +37,0 @@ "xmlbuilder": "^11.0.0",

@@ -212,3 +212,3 @@ Passport-SAML

Authentication requests sent by Passport-SAML can be signed using RSA-SHA1. To sign them you need to provide a private key in the PEM format via the `privateCert` configuration key. The certificate
can start with `-----BEGIN PRIVATE KEY-----` on its own line and end with `-----END PRIVATE KEY-----` on its own line, or have these lines stripped out.
should start with `-----BEGIN PRIVATE KEY-----` on its own line and end with `-----END PRIVATE KEY-----` on its own line.

@@ -221,10 +221,3 @@ For example:

Alternately:
```javascript
privateCert: 'MIICizCCAfQCCQCY8tKaMc0BMjANBgkqh ... W=='
```
It is a good idea to validate the signatures of the incoming SAML Responses. For this, you can provide the Identity Provider's public PEM-encoded X.509 signing certificate using the `cert` confguration key. The "BEGIN CERTIFICATE" and "END CERTIFICATE" lines should be stripped out and the certificate should be provided on a single line.

@@ -231,0 +224,0 @@

Sorry, the diff of this file is too big to display

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc