AWS athena high security documentation change
Summary
Added security update notes for v2.1.0.0: CSRF protection via RelayState validation and validation of login URL format.
Security assessment
Explicitly mentions a security update adding CSRF protection, which addresses a specific security vulnerability. Also adds validation for login URL format to prevent malicious URLs.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-browser-saml.md b/athena/latest/ug/odbc-v2-driver-browser-saml.md index 71ecba3b9..e0d0c056d 100644 --- a//athena/latest/ug/odbc-v2-driver-browser-saml.md +++ b//athena/latest/ug/odbc-v2-driver-browser-saml.md @@ -10,0 +11,4 @@ Browser SAML is a generic authentication plugin that can work with SAML based id +###### Note + +v2.1.0.0 security update: Starting in v2.1.0.0, the BrowserSAML plugin includes CSRF protection via RelayState validation. The driver generates a random state token, includes it as a RelayState parameter in the login URL, and validates it against the received response before accepting SAML assertions. + @@ -36,0 +41,4 @@ The single sign-on URL that is displayed for your application. +###### Important + +Starting in v2.1.0.0, the login URL must use HTTP or HTTPS protocol with a valid authority. The driver validates the URL format before initiating the authentication flow. +