How to prevent replay attack in IDP initiated SSO using SAML2

Question

In IDP initiated SSO, SAML response from IDP could be prone to replay attacks. Since SP has no awareness about the IDP initiated session till it gets the response, what are the possible ways to protect replay attack?

Answer 1

The SP should keep a list of IDs of accepted assertions, for the lifetime of the assertion to prevent Replay.

And re the ID change - that's not possible with a properly signed assertion/response. Nothing can be altered by a man-in-the-middle. If altering is possible, you have WAY bigger problems than just replay.