When using cd-theme, the login action redirects to Zen and use Zen's login system, which is fine when used on coderdojo.com, but not "good enough" when used on coderdojonsw.org.au.
Allowing a redirection to the requesting domain is necessary, but apart from whitelisting, I can't think of any way to avoid abuse of this redirect for malicious intent.
Thoughts? @rosalanghammer @DanielBrierton cc @Aryess
When using cd-theme, the login action redirects to Zen and use Zen's login system, which is fine when used on coderdojo.com, but not "good enough" when used on coderdojonsw.org.au. Allowing a redirection to the requesting domain is necessary, but apart from whitelisting, I can't think of any way to avoid abuse of this redirect for malicious intent. Thoughts? @rosalanghammer @DanielBrierton cc @Aryess