adorsys / adorsys/open-banking-gateway
Harden redirection URLs
Open
BE
good first issue
low priority
- Dominant language
- Java
- Stars
- 338
- Forks
- 122
- PR merge metrics
- No merged PRs in 30d
Description
As redirection URL is computed value that may come from 3rd party protocol, in order to protect user from phishing attacks, we need to add:
- [ ] API level whitelisting - redirect on endpoints only on whitelisted regex (global) - application.yml
- [ ] Facade level whitelisting - Facade should report redirects only to allowed whitelist entry per bank (per bank) - database table
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.