search

famedly / uia-proxy

GNU Affero General Public License v3.0
0 stars 0 forks source link

SSO: Handle url-unsafe characters in api.ts correctly #33

Closed famedly-bot closed 1 year ago

famedly-bot commented 2 years ago

Description

We should prevent issues like #32

Solution

The HTTP calls in api.ts should have their end-user input based variables properly URL encoded.

herr-rodrigo commented 1 year ago

Reviewed on refinement meeting with the Workflows team. Everything is clear to start to work on this.

pi-314 commented 1 year ago

The initial assumption turned out to be incorrect. Encoding of the user provided fields (actually two fields: userName and displayName) in api.ts would not fix the problem but cause many side effects, since the exact value of the userName is crucial for the wohl authentication logic. Furthermore, the content of JSON itself is already base64 encoded, so it can handle also that URL unsafe characters quite well. The initial issue ( #32 ) seems to be caused by the usage of that values in stage_com.famedly.login.sso.ts and appears to be already fixed.

Closing the story without changes in api.ts as the mentioned issue can no longer be reproduced.