adorsys / adorsys/open-banking-gateway

Redesign of FintechServer redirect

Abierto
#942 1 comentario 0 reacciones 0 asignados Ver en GitHub
BE FE FinTech
Lenguaje dominante
Java
Estrellas
338
Forks
122
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

Redirect approach in FintechServer is currently implemented like that:

```
FinTechUI:
- defines (ok,nok url) which are real endpoints in UI
- sends (ok,nok url) to FinTechServer

FintechServer:
- stores (ok,nok url) and uses new (ok2,nok2 url) as they are defined in
application.yml. These endpoints are real endpoints in FintechUI
- sends (ok2,nok2 url) to TPP

ConsentUI:
- after whole call is done consentUI eventually redirects to (ok2,nok2 url)
as given from FintechServer

FintechUI:
- UI of (ok2,nok2) url show confirmation and do call to FintechServer

FintechServer:
- with help of redirectCode original (ok,nok url) are retrieved from database
- confirmation of call from fintechUI now contains original (ok,nok url)

FintechUI:
- eventualy redirects to (ok,nok url)
```
-----------------------------------------------------------------
This involves FintechServer to have knowledge of FintechUI endpoints (ok2, nok2 url).

Better would be, FintechServer just has knowledge of FintechUI URL PREFIX
(e.g. https://obg-fintechui/).

Changes which need to be done:
-----------------------------------------------------------------
```
FinTechUI:
- defines (ok,nok url) which are real endpoints in UI
- sends (ok,nok url) to FinTechServer

FintechServer:
- add FINTECH_SERVER PREFIX to (ok,nok url)
- sends FINTECH_SERVER PREFIX(ok,nok url) to TPP
so Entitiy for storing redirect URLs can be removed. It is no more needed.


ConsentUI:
- after whole call is done consentUI eventually redirects to
FINTECH_SERVER PREFIX to (ok,nok url)
as given from FintechUI

FintechUI:
- UI of (ok,nok) url show confirmation and do call to FintechServer

FintechServer:
- confirmation of call from fintechUI DOES NOT any redirect URL

FintechUI:
- knows from previously stored information what to do next. Eg. show accounts,
showTransactions, or showPayment.


Further, to be safe regard xss attack, urls parameters should be known by fintechServer and checked.

```

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.