title: Should the same SAML Response be accepted twice, multiple times?
body: <p>Should a SAML federation software accept the same SAML response as long as it is within the allowed SAML token lifetime?</p>
  
  <p><strong>In simpler terms:</strong> IDP (identify provider) issues a SAML response, then SP (service provider) accepts/processes it. Can the same unmodified SAML response be then re-used immediately after the first use? Given that the SAML issuance timestamp is within allowed range.</p>
  
  <p>Security-wise it makes sense to restrict a SAML token (response) to only one use, so that even if it is stolen by a "man-in-the-middle" - it cannot be reused. But in order to implement that, the software needs to store some info about the SAML response somewhere: serial number, a hash of the whole thing?</p>
  
  <p>Please provide some links with the explanations on that is possible and/or examples of implementation.</p>
  
  <p>Thank you!
  Alex.</p>