BerriAI/litellm · error · HTTPException

SAML response references an unknown or already-used login re

Error message

SAML response references an unknown or already-used login request.

What it means

_enforce_response_binding looks up the AuthnRequest id referenced by InResponseTo in the cache and it is absent: the response points to a login request this server never issued or one whose state already expired/was consumed. Raised as 401 to block CSRF/replay.

Source

Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:370

        root: Final = OneLogin_Saml2_XML.to_etree(xml)
        for node in OneLogin_Saml2_XML.query(root, "//saml:SubjectConfirmationData[@InResponseTo]"):
            irt = cast(str | None, node.get("InResponseTo"))  # cast-ok: untyped python3-saml
            if irt:
                return irt
        return None

    @staticmethod
    async def _enforce_response_binding(
        auth: "OneLogin_Saml2_Auth",
        cache: DualCache,
        browser_request_id: str | None,
    ) -> None:
        in_response_to: Final = SAMLAuthHandler._response_in_response_to(auth)

        if in_response_to is not None:
            authn_key: Final = f"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{in_response_to}"
            if cache.get_cache(key=authn_key) is None:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="SAML response references an unknown or already-used login request.",
                )
            if browser_request_id is None or not secrets.compare_digest(browser_request_id, in_response_to):
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="SAML response is not bound to this browser's login request.",
                )
        elif browser_request_id is not None:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="SAML response is not bound to this browser's login request.",
            )
        elif not SAMLAuthHandler._bool_env("SAML_ALLOW_UNSOLICITED", False):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Unsolicited (IdP-initiated) SAML responses are disabled.",
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Restart the login flow from the proxy login page; the response references an unknown or used request.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:370 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/91796e611116bfb5. Report an issue: GitHub.