generator-jhipster icon indicating copy to clipboard operation
generator-jhipster copied to clipboard

Fix: Address User-Controlled Data Risk in isAuthenticated()

Open gantoin opened this issue 1 year ago • 1 comments

Related to https://github.com/jhipster/generator-jhipster/issues/27051

For enhancing application security, this PR modifies the isAuthenticated() endpoint to return a boolean indicating the authentication status instead of a potentially user-controlled value (principal.getName()). This change mitigates the risk of reflecting user-controlled data and strengthens the security of the application.


Please make sure the below checklist is followed for Pull Requests.

If the PR is not ready for review, please consider converting it to a Draft. You can also add the skip-ci label to prevent CI build on branch.

gantoin avatar Oct 12 '24 15:10 gantoin

CLA assistant check
All committers have signed the CLA.

CLAassistant avatar Oct 12 '24 15:10 CLAassistant

Any updates? Builds are currently failing.

mraible avatar Feb 08 '25 01:02 mraible

I guess https://github.com/jhipster/generator-jhipster/issues/27051 is fixed by https://github.com/jhipster/generator-jhipster/pull/28729 @mraible

gantoin avatar Jun 14 '25 13:06 gantoin