search

OneSignal / OneSignal-Website-SDK

OneSignal is a push notification service for web and mobile apps. This SDK makes it easy to integrate your website with OneSignal Push Notifications. https://onesignal.com
Other
386 stars 116 forks source link

[Question]: Very confused about externalId and security #1188

Open k2xl opened 3 weeks ago

k2xl commented 3 weeks ago

How can we help?

I'm hacking on a mobile app and trying to figure out how to sync external id and email with the user that registered for the notifications. However, based on the docs - it seems that the client can set this...

In other words, can any client call OneSignal.User.addEmail and then pass in anyone else's email?? Wouldn't this mean they are able to steal notifications from others if email is used as a targeting?

I'm creating a backend server endpoint as I would like to do this linking server side using the oneSignalId (i.e. i pass in the oneSignalId to the endpoint and then link the currently logged in user). Since there is a server rest api key that seems to be safer...

However, the SDK still seems to allow it locally so unclear how to stop someone from doing this.

netizen-ais commented 1 week ago

I've asked that last year, they said coming soon