Azure-Samples / Azure-Samples/ms-identity-android-java

[B2C Mode] Web UI Security Issues

Open
#55 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
34
Forks
30
PR merge metrics
No merged PRs in 30d

Description

> [B2C Mode] Web UI Security Issues
> ---------------------------------------------------------------

### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
>
1) Start Sample App
2) Select "B2C Mode"
3) Click "RUN USER FLOW"
4) Loading Web UI

### Any log messages given by the failure
>

### Expected/desired behavior
> URL exposed, causing security issues

ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE

![noname](https://user-images.githubusercontent.com/87524166/134866684-2bdcd72d-0cc7-4052-8049-65183a15dda8.png)

### OS and Version?
> Android 5~11+

### Versions
> targetSdkVersion 26~ 30 +

### Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.