{"record":{"id":"c6f950d67b83859d","repo":"wpscanteam/wpscan","slug":"saml-authentication-is-required-to-access-this-res-c6f950","errorCode":null,"errorMessage":"SAML authentication is required to access this resource. Please ensure correct authentication credentials.","messagePattern":"SAML authentication is required to access this resource\\. Please ensure correct authentication credentials\\.","errorType":"exception","errorClass":"WPScan::Error::SAMLAuthenticationFailed","httpStatus":null,"severity":"error","filePath":"lib/wpscan/browser_authenticator.rb","lineNumber":21,"sourceCode":"require 'ferrum'\n\nmodule WPScan\n  module BrowserAuthenticator\n    # Characters that, if present in a cookie name or value, would corrupt the\n    # serialized Cookie header. Per RFC 6265 these are forbidden in cookie-octets,\n    # but a noncompliant IdP could still emit them.\n    COOKIE_DELIMITERS = /[;,\\s]/\n\n    def self.authenticate(login_url)\n      unless $stdin.tty?\n        raise WPScan::Error::BrowserFailed,\n              'SAML authentication needs an interactive terminal to wait for login, but stdin is not a TTY. ' \\\n              'Run wpscan from a real shell when using --expect-saml.'\n      end\n\n      cookies = run_login_session(login_url)\n\n      raise WPScan::Error::SAMLAuthenticationFailed if cookies.nil? || cookies.empty?\n\n      serialize_cookies(cookies)\n    end\n\n    # Drives the interactive browser session and returns the resulting cookie jar.\n    # Translates Ferrum failures into BrowserFailed with a context-specific message.\n    def self.run_login_session(login_url)\n      browser = Ferrum::Browser.new(headless: false)\n\n      puts 'SAML authentication needed. Log in via the browser window that just opened, then press enter.'\n      browser.goto(login_url)\n      gets # Waits for user input\n\n      # Attempt an innocuous command to check if the browser is still responsive\n      browser.current_url\n\n      browser.cookies.all\n    rescue Ferrum::BinaryNotFoundError, Ferrum::EmptyPathError => e","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/wpscanteam/wpscan/blob/62c9cef471de90095f6b42245a11d0f8172d19c9/lib/wpscan/browser_authenticator.rb#L3-L39","documentation":"WPScan::Error::SAMLAuthenticationFailed raised in BrowserAuthenticator.authenticate (lib/wpscan/browser_authenticator.rb:21) when the interactive Ferrum session returns a nil or empty cookie jar (browser.cookies.all). Despite the 'ensure correct credentials' wording, it fires whenever zero cookies were captured after you press enter - the code never inspects whether the login itself succeeded, only that some cookies exist to serialize into a Cookie header.","triggerScenarios":"Pressing enter at the prompt before the IdP/SP set any cookies (e.g. before the redirect back to the target completes); the login_url being unreachable so no page ever sets cookies; the target not actually being SAML-protected; Ferrum's cookie API returning {} because the browser profile blocks cookies or the session landed on an error page.","commonSituations":"Impatient users hitting enter immediately; typo in the configured login URL; corporate proxy in front of the IdP breaking the redirect chain; browser extension-like interference is rare here, but Chrome instances with cached 'block all cookies' settings from a previous profile do occur.","solutions":["Re-run and wait: complete the login in the opened Chrome window, confirm the browser landed back on the target site, only then press enter","Verify the login URL opens and redirects correctly in a normal browser first","Confirm the resource is actually behind SAML (if it is not, remove --expect-saml)","Check the Chrome window for errors (cert warnings, proxy errors) - fix those, then retry"],"exampleFix":"# before\nSAML authentication needed. Log in via the browser window ... then press enter.\n<enter pressed while still on the IdP login form>\n# => SAMLAuthenticationFailed\n\n# after\nSAML authentication needed. Log in via the browser window ... then press enter.\n<complete login, wait until the target site is shown, then press enter>\n# => scan continues with the captured cookies","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  cookie_header = WPScan::BrowserAuthenticator.authenticate(login_url)\nrescue WPScan::Error::SAMLAuthenticationFailed\n  retry if (attempts += 1) < 3 # empty jar usually means 'enter pressed too early'\n  raise\nend","preventionTips":["Train users to wait until the browser shows the target site before pressing enter","Pre-verify the login URL and the SAML redirect chain in a normal browser","Treat repeated empty-jar results as a signal the target is not SAML-protected; drop --expect-saml"],"tags":["saml","cookies","ferrum","wpscan","ruby","authentication"],"backgroundTag":"saml-authentication-failed","analyzedSha":"62c9cef471de90095f6b42245a11d0f8172d19c9","analyzedAt":"2026-08-21T17:10:47.902Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}