title: In SAML Response should we sign Response or Assertion
body: <p>When returning SAML Response to SP, most IdP like AzureAD, Okta, Onelogin, GSuite have the following options about signature:</p>
  <ul>
  <li>sign Response</li>
  <li>sign Assertion</li>
  <li>sign Response and Assertion</li>
  </ul>
  <p>And without any configuration, for most IdP, the default for signature is to only sign Assertion.</p>
  <p>Below is a SAML Response example from AzureAD (the default signing option is sign Assertion). The Assertion is integrity protected and no tampering can be done. However fields other than Assertion, <code>Destination</code> <code>InResponseTo</code> <code>Issuer</code>, can be tampered with, or add/remove without knowledge!</p>
  <p><a href="https://i.stack.imgur.com/8Vu12.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8Vu12.png" alt="enter image description here" /></a></p>
  <p>So my question is:</p>
  <ol>
  <li>Why there are 3 kinds of signing? (Response, Assertion, Response &amp; Assertion)</li>
  <li>In which use case should we choose to sign the whole Response, sign the Assertion or sign both Response and Assertion?</li>
  <li>By only signing Assertion (as default by most IdP), do we exposed to any vulnerabilities?</li>
  </ol>