Skip to content

Signing algorithm ignored for POST binding (sigalg vs sign_alg mismatch) #433

Open

Description

@JPDSousa

In LoginView.get, in POST binding mode, it looks like the signing algorithm (sigalg) is silently ignored because it's passed with the wrong parameter name to create_authn_request (source). The function call doesn't fail as create_authn_request ignores unknown parameters.

Activity

  1. JPDSousa commented on Jun 8, 2026

    @JPDSousa
    Author

    I've opened #432 with a proposed fix (i.e., rename + test)

  2. JPDSousa commented on Jun 24, 2026

    @JPDSousa
    Author

    @peppelinux 👋 What are the next steps here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions