The signature check and the login read different nodes

The signature check can read <saml:Assertion ID="legit"> while document.getElementsByTagName("saml:Assertion")[0] reads <saml:Assertion ID="evil">.

Step 1 of 1