inrupt / inrupt/solid-client-authn-js
Question: Does the `handleIncomingRedirect` need to be called as the first thing that loads in the page?
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 77
- Forks
- 49
- Avg merge
- 18h 20m
- Merged PRs (30d)
- 32
Description
Search terms you've used
handleIncomingRedirect
Impacted environment
In which environment would the proposed feature apply ?
- The browser
Feature suggestion
If the url query parameters of code and state are accessible to third party scripts loaded into the page, could they copy these to hijack a users session? If so is this important or is it unlikely to happen (because you control the scripts you load into your page).
In terms of security best practice, do we need to ensure the handleIncomingRedirect function is called as the first thing before other scripts are loaded into the page?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the handleIncomingRedirect entry point and the browser authentication flow. Determine whether code and state exposure creates a documented security requirement about call order, then record the resulting guidance for browser users.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100