Genesys Cloud - Developer Announcements!

 View Only

Sign Up

  • 1.  SAML responses delivered by HTTP GET will be rejected at the Assertion Consumer Service

    Posted 09-04-2026 11:11

    Summary

    Genesys Cloud's SAML Assertion Consumer Service (ACS) endpoint currently accepts a SAML response delivered as an HTTP GET request with the SAMLResponse parameter in the URL query string, in addition to the standard delivery by HTTP POST. Following this change, a GET request carrying a SAMLResponse will be rejected with HTTP 405 (Method Not Allowed) and the assertion will not be processed.

    SAML 2.0 permits the <Response> message to be delivered to the service provider only by the HTTP POST or HTTP Artifact binding. Delivery by the HTTP Redirect binding — which places SAMLResponse in the URL query string — is explicitly prohibited: "The HTTP Redirect binding MUST NOT be used, as the response will typically exceed the URL length permitted by most user agents" (SAML V2.0 Profiles, §4.1.2). Accepting it placed the SAML assertion, and the identity data it contains, in the request URL, where it can be retained in browser history, proxy and web server access logs, and Referer headers.

    This change aligns the Genesys Cloud SAML implementation with the SAML 2.0 specification and addresses findings identified through security testing.

    Effective Date

    Monday, September 28, 2026

    Customer Impact

    This change affects only identity provider (IdP) or SSO configurations that deliver the SAML response to Genesys Cloud using HTTP GET, with the assertion included in the query string.

    After this change:

    • GET /saml requests containing a SAMLResponse query parameter will return HTTP 405 (Method Not Allowed).
    • The SAML assertion included in such requests will not be processed.
    • Users relying on an affected configuration will be unable to complete SAML sign-in until the identity provider is configured to deliver the SAML response using HTTP POST.

    Identity providers that already deliver SAML responses using HTTP POST are unaffected. This is the standard behavior for mainstream identity providers, and no configuration changes are required for those environments.

    Customer Action Required

    Customers using SAML SSO should verify that their identity provider delivers SAML responses to the Genesys Cloud Assertion Consumer Service using HTTP POST.

    Customers whose identity provider currently sends SAMLResponse through an HTTP GET query parameter must update the IdP configuration to use HTTP POST before the effective date to prevent SAML authentication failures.

    Impacted Resources

    GET /saml (Assertion Consumer Service) — requests containing a SAMLResponse query parameter will be rejected.

    POST /saml — no change.

    Issue References

    IAM-4865

    Contacts

    @David Murray  

    Please reply to this announcement with any questions. This helps the wider developer community benefit from the discussion. We encourage you to use this thread before contacting the designated person directly. Thank you for your understanding.



  • 2.  RE: SAML responses delivered by HTTP GET will be rejected at the Assertion Consumer Service

    Posted 09-04-2026 17:23

    Thank you.



    ------------------------------
    Camila Meneghini
    ------------------------------



  • 3.  RE: SAML responses delivered by HTTP GET will be rejected at the Assertion Consumer Service

    Posted 14 days ago

    I just wanted to add a few additional comments to this, as I've had some questions about whether customers need to make configuration changes, related to this announcement.

    There should be no configuration changes required as a result of this change.  We are simply correcting a pattern that we should not have allowed, per the SAML spec.  Identity Providers should not be sending these requests.  

    However, a pen test identified that, if they did, we would accept and respond to them, potentially exposing sensitive data (e.g. email address info) in logs.  It is a low-level vulnerability but we needed to correct this and have been requested to get this done by end of month.  We created the announcement so that, in the very unlikely event that an IdP is sending requests in this way (which the SAML spec says they should not), we will reject them, so it provides an opportunity for the IdP to correct their (incorrect) implementation.  

    This announcement was published out of an abundance of caution as, technically, it is a breaking change.  We will be implementing this change, starting on Sep 28th, in line with the usual regional feature toggle rollout.  



    ------------------------------
    David Murray
    Principal Product Manager
    Genesys Cloud
    ------------------------------



Related Content