Azure-Samples / Azure-Samples/ms-identity-android-java
[B2C Mode] Web UI Security Issues
- Dominant language
- Java
- Stars
- 34
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
> [B2C Mode] Web UI Security Issues
> ---------------------------------------------------------------
### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```
### Minimal steps to reproduce
>
1) Start Sample App
2) Select "B2C Mode"
3) Click "RUN USER FLOW"
4) Loading Web UI
### Any log messages given by the failure
>
### Expected/desired behavior
> URL exposed, causing security issues
ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE

### OS and Version?
> Android 5~11+
### Versions
> targetSdkVersion 26~ 30 +
### Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.
Contributor guide
Research direction
No files or tests are named. Start by running the Sample App, selecting B2C Mode, and using RUN USER FLOW to reproduce the exposed URL; then trace the Android Web UI integration. Done should mean the URL is no longer exposed as reported, or the requested WebView customization or hiding behavior is clearly defined and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- authentication, mobile, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100