search

finos / FDC3-Sail

Open implementation of the FDC3 standard using Electron and an integrated App Directory.
Apache License 2.0
34 stars 26 forks source link

Secure launching of external origins #130

Closed nkolba closed 1 year ago

nkolba commented 1 year ago

By default, Sail restricts apps from opening windows in new origins. Apps that used OAuth redirects or launched other apps or URLs would get blocked and fail silently. There was a mechanism in place for adding trusted origins - but this was within the security-restrictions.ts file (in main)- which meant the list essentially had to be hard coded in.

This PR adds a new property to the SailManifest for apps in the App Directory that can list any number of trusted origins for the app (note : this assumes the directory can be trusted). The App is then allowed to launch these origins and/or redirect to them.

Also, if a non-trusted origin is now launched by an app, it will now open in the default browser (instead of just failing).

robmoffat commented 1 year ago

what's the use case behind this @nkolba?

robmoffat commented 1 year ago

ok, just saw Pierre's email - I get it now