adorsys / adorsys/open-banking-gateway
Harden redirection URLs
Abierto
BE
good first issue
low priority
- Lenguaje dominante
- Java
- Estrellas
- 338
- Forks
- 122
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
As redirection URL is computed value that may come from 3rd party protocol, in order to protect user from phishing attacks, we need to add:
- [ ] API level whitelisting - redirect on endpoints only on whitelisted regex (global) - application.yml
- [ ] Facade level whitelisting - Facade should report redirects only to allowed whitelist entry per bank (per bank) - database table
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.