Fix CSRF token leakage in SAML POST binding template (#241)

tyage · Zogoo · web-flow · commit 4dde1a3cb9b7 · 2026-02-02T11:38:03.000+01:00
Co-authored-by: zogoo &lt;chtsogbadrakh@gmail.com&gt;
diff --git a/spec/rails_app/app/views/saml_idp/idp/saml_post.html.erb b/spec/rails_app/app/views/saml_idp/idp/saml_post.html.erb
@@ -5,10 +5,10 @@
     <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
   </head>
   <body onload="document.forms[0].submit();" style="visibility:hidden;">
-    <%= form_tag(saml_acs_url) do %>
+    <form action="<%= saml_acs_url %>" method="post">
       <%= hidden_field_tag("SAMLResponse", @saml_response) %>
       <%= hidden_field_tag("RelayState", params[:RelayState]) %>
       <%= submit_tag "Submit" %>
-    <% end %>
+    </form>
   </body>
 </html>
