open-banking-gateway icon indicating copy to clipboard operation
open-banking-gateway copied to clipboard

Published 20 hours ago • verified publisher icon adorsys

Harden redirection URLs

Open valb3r opened this issue 5 years ago • 0 comments
trafficstars

As redirection URL is computed value that may come from 3rd party protocol, in order to protect user from phishing attacks, we need to add:

  • [ ] API level whitelisting - redirect on endpoints only on whitelisted regex (global) - application.yml
  • [ ] Facade level whitelisting - Facade should report redirects only to allowed whitelist entry per bank (per bank) - database table

valb3r avatar Feb 07 '20 15:02 valb3r