All free flowsCheck Time Bounds in an Encoded SAML Message
Decode a SAML message and check every Conditions time window against your explicit instant and skew, retaining the complete XML, projected inputs and original reports.
Processing stays in your browser; code and assets download as needed. Original and checkpoint downloads retain source content, including omitted values. Reset and Exit stop this session’s owned work; they do not establish secure erasure or anonymity.
This flow needs JavaScript. If it does not load, refresh the page and try again.
About this flow
Decode a SAML message and check every Conditions time window against your explicit instant and skew, retaining the complete XML, projected inputs and original reports.
Limitations
- Choose or paste a canonical Base64 SAML POST or raw-DEFLATE Redirect parameter value, up to 100,000 units and 400,000 bytes. Select the binding and enter an explicit zoned evaluation instant and 0–600 seconds skew. Every 1–20 assertion-namespace Conditions element is checked, in source element order, using the original start-inclusive/end-exclusive comparisons. Zero or more than 20 elements, missing/invalid/reversed bounds or an invalid instant retain the complete decoder checkpoint. The final ZIP keeps the raw source, original XML and decoder report, every projected time input and complete original time report. Child-index paths identify elements; projections keep only NotBefore and NotOnOrAfter. No signature, trust, issuer, audience, SubjectConfirmationData, schema or authentication validation, or current server-clock claim. External resources are never fetched and private values remain unredacted. Original decoder/worker limits remain.
- B25 decoder and original30second workers unchanged. Owned90second time consumer,8MiB ZIP/4MiB entry/45 final members,1–20 Conditions. Source filename512 units. Instant single-line128 units. Original namespace parser20k elements/40depth, bounded synchronous XML parse; association reuses B25 decoder owner.
- Reuses unchanged B25 checkpoint profile/role and four members; its decoder-stage policy correctly records that decoding itself performs no time verification. New final time reports remain limited to projected NotBefore/NotOnOrAfter only.
