Which messages are typically used in single sign-on protocols and are often Base64-encoded?

• A. Vega
• B. WhatWeb
• C. SAML messages
• D. httprint

Answer: (C)

When evaluating single sign-on, the messages that travel between the identity provider and the service provider are the protocol messages used to assert identity and request access. In most SSO deployments, these are SAML messages—XML-based payloads that carry authentication requests and responses, including assertions about the user. To transport these messages through a browser (in HTTP POST or Redirect bindings) they are commonly Base64-encoded, which safely encodes the XML for insertion into forms or URLs. The other names listed refer to scanning or fingerprinting tools, not the message formats used in SSO, so they aren’t the typical SSO protocol messages.