Skip to content

Commit c01f6a4

Browse files
Update README.md
Simplified documentation for the `slo_relay_state_validator`.
1 parent be0f3be commit c01f6a4

1 file changed

Lines changed: 9 additions & 11 deletions

File tree

README.md

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -101,20 +101,18 @@ Note that when [integrating with Devise](#devise-integration), the URL path will
101101
* `:slo_default_relay_state` - The value to use as default `RelayState` for single log outs. The
102102
value can be a string, or a `Proc` (or other object responding to `call`). The `request`
103103
instance will be passed to this callable if it has an arity of 1. If the value is a string,
104-
the string will be returned, when the `RelayState` is called. Optional.
104+
the string will be returned, when the `RelayState` is called.
105+
The value is assumed to be safe and is not validated by `:slo_relay_state_validator`.
106+
Optional.
105107

106108
* `:slo_enabled` - Enables or disables Single Logout (SLO). Set to `false` to disable SLO. Defaults to `true`. Optional.
107109

108-
* `:slo_relay_state_validator` - A callable used to validate any RelayState before OmniAuth uses it for
109-
redirects in Single Logout flows. The callable receives the RelayState value and, if it accepts a
110-
second argument, the current Rack request. The default validator allows only relative paths beginning
111-
with `/` and rejects absolute URLs, invalid URIs, protocol-relative URLs, and other schemes. Defaults
112-
generated via `:slo_default_relay_state` are assumed to be safe and skipped by this validation step.
113-
Optional. When set to `true`, every RelayState value is accepted. When set to
114-
`false` (or any other falsy value), every provided RelayState is rejected and the strategy falls back
115-
to the default RelayState. See the SLO relay state validator specs in
116-
[`spec/omniauth/strategies/saml_spec.rb`](spec/omniauth/strategies/saml_spec.rb) for additional
117-
examples.
110+
* `:slo_relay_state_validator` - A callable used to validate any `RelayState` before performing the redirect
111+
in Single Logout flows. The callable receives the RelayState value and the current Rack request.
112+
If unset, the default validator is used. The default validator allows only relative paths beginning
113+
with `/` and rejects absolute URLs, invalid URIs, protocol-relative URLs, and other schemes.
114+
If the given `RelayState` is considered invalid then the `slo_default_relay_state` value is used for the SLO redirect.
115+
Optional.
118116

119117
* `:idp_sso_service_url_runtime_params` - A dynamic mapping of request params that exist
120118
during the request phase of OmniAuth that should to be sent to the IdP after a specific

0 commit comments

Comments
 (0)