search

chb / indivo_server

The Indivo™ Personally Controlled Health Record
http://indivohealth.org
GNU General Public License v3.0
103 stars 40 forks source link

Django HttpResponseRedirect security update breaks iOSFramework support #40

Open Travers opened 12 years ago

Travers commented 12 years ago

To combat XSS, Django has altered HttpResponseRedirect to contain a list of allowed_schemes. Since we try to redirect to the indivo-framework scheme as part of our auth flow, this will now cause a SuspiciousOperation Exception to be raised in the patched versions of Django.

p2 commented 12 years ago

We can address that when updating the OAuth flow to match SMART 0.6: selecting a record is the correct callback link already, we don't need to go back to the UI server and do a redirect from there.