@@ -101,20 +101,18 @@ Note that when [integrating with Devise](#devise-integration), the URL path will
101101* ` :slo_default_relay_state ` - The value to use as default ` RelayState ` for single log outs. The
102102 value can be a string, or a ` Proc ` (or other object responding to ` call ` ). The ` request `
103103 instance will be passed to this callable if it has an arity of 1. If the value is a string,
104- the string will be returned, when the ` RelayState ` is called. Optional.
104+ the string will be returned, when the ` RelayState ` is called.
105+ The value is assumed to be safe and is not validated by ` :slo_relay_state_validator ` .
106+ Optional.
105107
106108* ` :slo_enabled ` - Enables or disables Single Logout (SLO). Set to ` false ` to disable SLO. Defaults to ` true ` . Optional.
107109
108- * ` :slo_relay_state_validator ` - A callable used to validate any RelayState before OmniAuth uses it for
109- redirects in Single Logout flows. The callable receives the RelayState value and, if it accepts a
110- second argument, the current Rack request. The default validator allows only relative paths beginning
111- with ` / ` and rejects absolute URLs, invalid URIs, protocol-relative URLs, and other schemes. Defaults
112- generated via ` :slo_default_relay_state ` are assumed to be safe and skipped by this validation step.
113- Optional. When set to ` true ` , every RelayState value is accepted. When set to
114- ` false ` (or any other falsy value), every provided RelayState is rejected and the strategy falls back
115- to the default RelayState. See the SLO relay state validator specs in
116- [ ` spec/omniauth/strategies/saml_spec.rb ` ] ( spec/omniauth/strategies/saml_spec.rb ) for additional
117- examples.
110+ * ` :slo_relay_state_validator ` - A callable used to validate any ` RelayState ` before performing the redirect
111+ in Single Logout flows. The callable receives the RelayState value and the current Rack request.
112+ If unset, the default validator is used. The default validator allows only relative paths beginning
113+ with ` / ` and rejects absolute URLs, invalid URIs, protocol-relative URLs, and other schemes.
114+ If the given ` RelayState ` is considered invalid then the ` slo_default_relay_state ` value is used for the SLO redirect.
115+ Optional.
118116
119117* ` :idp_sso_service_url_runtime_params ` - A dynamic mapping of request params that exist
120118 during the request phase of OmniAuth that should to be sent to the IdP after a specific
0 commit comments