adorsys / adorsys/open-banking-gateway

Redesign of FintechServer redirect

オープン
#942 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
BE FE FinTech
主要言語
Java
スター
338
フォーク
122
PR マージ指標
30日以内にマージされた PR はありません

説明

Redirect approach in FintechServer is currently implemented like that:

```
FinTechUI:
- defines (ok,nok url) which are real endpoints in UI
- sends (ok,nok url) to FinTechServer

FintechServer:
- stores (ok,nok url) and uses new (ok2,nok2 url) as they are defined in
application.yml. These endpoints are real endpoints in FintechUI
- sends (ok2,nok2 url) to TPP

ConsentUI:
- after whole call is done consentUI eventually redirects to (ok2,nok2 url)
as given from FintechServer

FintechUI:
- UI of (ok2,nok2) url show confirmation and do call to FintechServer

FintechServer:
- with help of redirectCode original (ok,nok url) are retrieved from database
- confirmation of call from fintechUI now contains original (ok,nok url)

FintechUI:
- eventualy redirects to (ok,nok url)
```
-----------------------------------------------------------------
This involves FintechServer to have knowledge of FintechUI endpoints (ok2, nok2 url).

Better would be, FintechServer just has knowledge of FintechUI URL PREFIX
(e.g. https://obg-fintechui/).

Changes which need to be done:
-----------------------------------------------------------------
```
FinTechUI:
- defines (ok,nok url) which are real endpoints in UI
- sends (ok,nok url) to FinTechServer

FintechServer:
- add FINTECH_SERVER PREFIX to (ok,nok url)
- sends FINTECH_SERVER PREFIX(ok,nok url) to TPP
so Entitiy for storing redirect URLs can be removed. It is no more needed.


ConsentUI:
- after whole call is done consentUI eventually redirects to
FINTECH_SERVER PREFIX to (ok,nok url)
as given from FintechUI

FintechUI:
- UI of (ok,nok) url show confirmation and do call to FintechServer

FintechServer:
- confirmation of call from fintechUI DOES NOT any redirect URL

FintechUI:
- knows from previously stored information what to do next. Eg. show accounts,
showTransactions, or showPayment.


Further, to be safe regard xss attack, urls parameters should be known by fintechServer and checked.

```

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。