Reply to post: Only vulnerable if you use HTTP-POST binding

Only vulnerable if you use HTTP-POST binding

Only vulnerable if you use HTTP-POST binding to deliver the SamlResponse to the service provider, if you are using other bindings like HTTP-Artifact then there is no chance for the response to be modified.

Admittedly, that is the most common - I don't know why, it makes the client requirements so much stronger.