title: SAML2.0 Authentication with Node.js and SPA
body: <p>I've been scratching my head for about 2 days on how to solve what seemed to be a simple task, but it's starting to drive me crazy.</p>
  
  <p>I have an application where users will use SAML 2.0 to authenticate.
  I have a react-application set up for the front-end, and was thinking I was gonna use JWT to secure the rest-api communication between front-end and backend.</p>
  
  <p>When a user signs in, the flow is the following:</p>
  
  <ol>
  <li>User accesses www.server.com/ and gets served the static HTML with react-application</li>
  <li>User clicks 'Sign in' and accesses www.server.com/login</li>
  <li>passport-saml redirects user to saml identity provider. User logs in.</li>
  <li>User calls back to www.server.com/callback with a SamlResponse in the req.body which is decoded by passport-saml and put into req.user.</li>
  <li>If the user doesn't already exist, I create the user in the database.</li>
  <li>I create a JWT.</li>
  </ol>
  
  <p>What should I do next? The problem is that the user is not in the react-application when calling back from the identity provider, so I've lost all state in the application, so whatever I reply with will get sent to the browser.</p>
  
  <p>Is there any way I could force the browser to give me the SamlResponse which the identityprovider is calling back with? Then I could send it to the server as a http-request from the react-application.</p>