Identity federation session replay is a quiet threat that rides on top of convenience. Single sign-on makes cross-platform access seamless, but it also means a federated token can outlive the browser tab. When a session is hijacked or replayed, an attacker doesn’t need passwords. They need the token. That token is the skeleton key to your systems.
Session replay attacks exploit how identity providers issue and validate authentication assertions. The SAML or OpenID Connect payload contains cryptographically signed data that downstream services trust. But trust has a lifespan. If your system accepts a replayed assertion without enforcing strict expiration, origin checks, or binding it to the original client, you open a door that stays open too long.
Mitigation starts with shortening token lifetimes and binding them to unique device fingerprints. Require nonce values to ensure each assertion is valid only once. Implement strict audience and issuer validation at every relying party. Demand TLS everywhere, and invalidate sessions immediately when logout or idle thresholds trigger. Monitor for duplicate assertion IDs and block replay before it spreads.