SAML: A Fractal of Bad Design

Trail of Bits has published a critical analysis of Security Assertion Markup Language (SAML), characterizing the authentication standard as a 'fractal of bad design.' The report highlights how the inherent complexity of the XML-based protocol creates significant security vulnerabilities, often leading to implementation flaws that developers struggle to mitigate. By examining the history and technical architecture of SAML, the researchers argue that the standard's design choices—such as its reliance on complex XML processing and ambiguous specifications—make it prone to common attacks like XML Signature Wrapping. The article serves as a warning for security engineers and developers, emphasizing that the inherent fragility of SAML often outweighs its utility in modern identity management systems. The authors advocate for a shift toward more modern, simplified authentication protocols that prioritize security by design rather than retrofitting safety onto legacy, overly complex frameworks.