SAML Is Insecure by Design
What kills me about SAML is that instead of this straightforward XML style:<p><pre><code>    &lt;claims&gt;
        &lt;nameid&gt;foo.bar@test.com&lt;&#x2F;nameid&gt;
        &lt;givenname&gt;Foo&lt;&#x2F;givenname&gt;
        &lt;surname&gt;Bar&lt;&#x2F;surname&gt;    
    &lt;&#x2F;claims&gt;
</code></pre>
It instead encodes elements and attributes <i>using</i> elements and attributes, in the manner of the classic &quot;inner platform effect&quot; anti-pattern:<p><pre><code>    &lt;saml:AttributeStatement&gt;
      &lt;saml:Attribute Name=&quot;uid&quot; NameFormat=&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;&gt;
        &lt;saml:AttributeValue xsi:type=&quot;xs:string&quot;&gt;test&lt;&#x2F;saml:AttributeValue&gt;
      &lt;&#x2F;saml:Attribute&gt;
      &lt;saml:Attribute Name=&quot;mail&quot; NameFormat=&quot;urn:oasis:names:tc:SAML:2.0:attrname-format:basic&quot;&gt;
        &lt;saml:AttributeValue xsi:type=&quot;xs:string&quot;&gt;foo.bar@test.com&lt;&#x2F;saml:AttributeValue&gt;
      &lt;&#x2F;saml:Attribute&gt;
    &lt;&#x2F;saml:AttributeStatement&gt;    
</code></pre>
This is roughly the equivalent of the SQL table schema where there&#x27;s one table with the columns &quot;rowid, columnname, value&quot; along with a &quot;schema table&quot; that some hand-rolled code uses to validate that the data table contains only data that is valid according to the schema.<p>It&#x27;s not XML, it&#x27;s XML <i>squared:</i> using XML to <i>encode</i> XML concepts instead of just using XML directly.