Assert that signed messages on the Redirect- and POST-bindings have a destination set

Author: tvdijen

src/SAML2/HTTPPost.php

@@ -87,6 +87,17 @@ public function receive(): Message
 
         $msg = Message::fromXML($document->firstChild);
 
+        /**
+         * 3.5.5.2 - SAML Bindings
+         *
+         * If the message is signed, the Destination XML attribute in the root SAML element of the protocol
+         * message MUST contain the URL to which the sender has instructed the user agent to deliver the
+         * message.
+         */
+        if ($msg->isMessageConstructedWithSignature()) {
+            Assert::notNull($msg->getDestination()); // Validation of the value must be done upstream
+        }
+
         if (array_key_exists('RelayState', $_POST)) {
             $msg->setRelayState($_POST['RelayState']);
         }

src/SAML2/HTTPRedirect.php

@@ -141,6 +141,15 @@ public function receive(): Message
             return $message;
         }
 
+        /**
+         * 3.4.5.2 - SAML Bindings
+         *
+         * If the message is signed, the Destination XML attribute in the root SAML element of the protocol
+         * message MUST contain the URL to which the sender has instructed the user agent to deliver the
+         * message.
+         */
+        Assert::notNull($message->getDestination()); // Validation of the value must be done upstream
+
         if (!array_key_exists('SigAlg', $data)) {
             throw new \Exception('Missing signature algorithm.');
         }