No More Peeking: Cloudflare Access Now Encrypts SAML Assertions!
Hi there, it's me, Shiichan! Today I've got a nice little security boost for Cloudflare Access to share with you.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Over on Cloudflare's Changelog, they announced that Cloudflare Access now supports SAML assertion encryption. When you connect an identity provider (IdP), you can now have the SAML assertions encrypted in transit.
The story so far
When you log in with SAML, the assertion your IdP issues (the identity data about who logged in) travels through the user's browser on its way to Access. TLS protects it, but once TLS is terminated in the browser there's a moment where the contents are in plaintext, which left it exposed to malicious browser extensions or client-side malware.
What changes
When you turn this on, your IdP uses a Cloudflare-managed certificate to encrypt the SAML assertion before it's sent through the browser. So even after TLS terminates, the contents stay encrypted, and your identity data won't leak in plaintext even if someone peeks along the way.
Dive Deep
The certificate handling is pretty thoughtful.
- When you enable encryption, the certificate is generated automatically.
- You can rotate the certificate without any service interruption, and the previous certificate stays valid until it expires, so logins won't break during the switchover.
- You can export the certificate as PEM, so you can upload it to your IdP manually or let it be fetched automatically from the SAML metadata endpoint.
The setup steps are all laid out in the Encrypt SAML assertions guide.
Wrap-up
- Cloudflare Access now supports SAML assertion encryption.
- Identity data stays encrypted even after TLS terminates, making it more resistant to snooping by browser extensions or malware.
- Certificates support automatic generation, zero-downtime rotation, and PEM export.
- This one's for the security folks running SAML/SSO!
