{"record":{"id":"466e3eb940cf3f19","repo":"BerriAI/litellm","slug":"saml-response-is-not-bound-to-this-browser-s-login","errorCode":null,"errorMessage":"SAML response is not bound to this browser's login request.","messagePattern":"SAML response is not bound to this browser's login request\\.","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/sso/saml_sso.py","lineNumber":375,"sourceCode":"        return None\n\n    @staticmethod\n    async def _enforce_response_binding(\n        auth: \"OneLogin_Saml2_Auth\",\n        cache: DualCache,\n        browser_request_id: str | None,\n    ) -> None:\n        in_response_to: Final = SAMLAuthHandler._response_in_response_to(auth)\n\n        if in_response_to is not None:\n            authn_key: Final = f\"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{in_response_to}\"\n            if cache.get_cache(key=authn_key) is None:\n                raise HTTPException(\n                    status_code=status.HTTP_401_UNAUTHORIZED,\n                    detail=\"SAML response references an unknown or already-used login request.\",\n                )\n            if browser_request_id is None or not secrets.compare_digest(browser_request_id, in_response_to):\n                raise HTTPException(\n                    status_code=status.HTTP_401_UNAUTHORIZED,\n                    detail=\"SAML response is not bound to this browser's login request.\",\n                )\n        elif browser_request_id is not None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"SAML response is not bound to this browser's login request.\",\n            )\n        elif not SAMLAuthHandler._bool_env(\"SAML_ALLOW_UNSOLICITED\", False):\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=\"Unsolicited (IdP-initiated) SAML responses are disabled.\",\n            )\n        elif cache.redis_cache is None:\n            raise HTTPException(\n                status_code=status.HTTP_401_UNAUTHORIZED,\n                detail=(\n                    \"Unsolicited (IdP-initiated) SAML responses require a shared Redis cache \"","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/sso/saml_sso.py#L357-L393","documentation":"The response references a known AuthnRequest, but the browser's state cookie does not match the InResponseTo id (constant-time compare fails or cookie is missing): the SAML response was delivered in a different browser session than the one that started login. Raised as 401.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/sso/saml_sso.py:375 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Complete the login in the same browser session that started it (cookies required)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}