Azure-Samples / Azure-Samples/ms-identity-android-java

[B2C Mode] Web UI Security Issues

Open
#55 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
34
Forks
30
PR merge metrics
No merged PRs in 30d

Description

> [B2C Mode] Web UI Security Issues
> ---------------------------------------------------------------

### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
>
1) Start Sample App
2) Select "B2C Mode"
3) Click "RUN USER FLOW"
4) Loading Web UI

### Any log messages given by the failure
>

### Expected/desired behavior
> URL exposed, causing security issues

ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE

![noname](https://user-images.githubusercontent.com/87524166/134866684-2bdcd72d-0cc7-4052-8049-65183a15dda8.png)

### OS and Version?
> Android 5~11+

### Versions
> targetSdkVersion 26~ 30 +

### Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.

Contributor guide

Open the contributing guide

Research direction

No files or tests are named. Start by running the Sample App, selecting B2C Mode, and using RUN USER FLOW to reproduce the exposed URL; then trace the Android Web UI integration. Done should mean the URL is no longer exposed as reported, or the requested WebView customization or hiding behavior is clearly defined and verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
authentication, mobile, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.