Azure-Samples / Azure-Samples/ms-identity-android-java
[B2C Mode] Web UI Security Issues
- Ngôn ngữ chính
- Java
- Star
- 34
- Fork
- 30
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
> [B2C Mode] Web UI Security Issues
> ---------------------------------------------------------------
### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```
### Minimal steps to reproduce
>
1) Start Sample App
2) Select "B2C Mode"
3) Click "RUN USER FLOW"
4) Loading Web UI
### Any log messages given by the failure
>
### Expected/desired behavior
> URL exposed, causing security issues
ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE

### OS and Version?
> Android 5~11+
### Versions
> targetSdkVersion 26~ 30 +
### Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.
Hướng dẫn đóng góp
Hướng nghiên cứu
No files or tests are named. Start by running the Sample App, selecting B2C Mode, and using RUN USER FLOW to reproduce the exposed URL; then trace the Android Web UI integration. Done should mean the URL is no longer exposed as reported, or the requested WebView customization or hiding behavior is clearly defined and verified.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- android, java
- Lĩnh vực
- authentication, mobile, security
- Loại issue
- Tính năng
- Độ khó
- 4/5
- Thời gian dự kiến
- 3-5 ngày
- Mức độ hoạt động
- Đình trệ
- Độ rõ ràng
- Cần làm rõ
- Mức phù hợp với người mới
- 25/100