Azure-Samples / Azure-Samples/ms-identity-android-java
[B2C Mode] Web UI Security Issues
- 主要語言
- Java
- 星號
- 34
- 分支
- 30
- PR 合併指標
- 30 天內沒有已合併 PR
描述
> [B2C Mode] Web UI Security Issues
> ---------------------------------------------------------------
### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```
### Minimal steps to reproduce
>
1) Start Sample App
2) Select "B2C Mode"
3) Click "RUN USER FLOW"
4) Loading Web UI
### Any log messages given by the failure
>
### Expected/desired behavior
> URL exposed, causing security issues
ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE

### OS and Version?
> Android 5~11+
### Versions
> targetSdkVersion 26~ 30 +
### Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.
貢獻指南
研究方向
未指定檔案或測試。首先執行 Sample App,選取 B2C Mode,並使用 RUN USER FLOW 重現暴露的 URL;接著追蹤 Android Web UI 整合。只有在 URL 不再如回報中所述遭到暴露,或所要求的 WebView 自訂或隱藏行為已明確定義並完成驗證時,才算完成。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- android, java
- 領域
- authentication, mobile, security
- Issue 類型
- 功能
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 停滯
- 描述清晰度
- 需要釐清
- 新手友好度
- 25/100